Risk assessment method and device for user information security, electronic equipment and medium

Abstract

The invention provides a risk assessment method and device for user information security, electronic equipment and a medium, and relates to the technical field of data processing, in particular to the technical field of natural language processing, large language models and information security. According to the implementation scheme, first page data of a first page of a target application program are obtained, the first page is used for displaying a privacy policy which describes the target application program and is about a user information list, and the first page comprises at least one first link; processing the first page data using a large model for: screening at least one second link from the at least one first link, each second link in the at least one second link indicating a first sub-page for displaying other content except the privacy policy; extracting an evaluation data list from the first page data after the at least one second link is excluded; and evaluating the information security risk degree when the user uses the target application program according to the evaluation data list.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, in particular to the field of natural language processing, large language models and information security technology, and specifically to a method, device, electronic device, computer-readable storage medium and computer program product for risk assessment of user information security. Background Art

[0002] An application's privacy policy usually includes how the application collects, uses, stores, shares, and destroys users' personal information, as well as how users can query, correct, delete, and withdraw authorization for their personal information. It is an important way for developers to make public announcements to users.

[0003] The content in the application's privacy policy page can be semantically identified to determine a list of user information that may be involved in the use of the application, thereby determining the degree of information security risk when the user uses the application based on the aforementioned user information list.

[0004] However, the privacy policy page of an application usually includes a lot of content that is not related to the privacy policy. Therefore, this method of directly performing semantic recognition on the entire privacy policy page not only consumes a lot of model resources, but also the accuracy of the semantic recognition results is not high, which will make the final risk assessment results unreliable. Summary of the invention

[0005] The present disclosure provides a user information security risk assessment method, device, electronic device, computer-readable storage medium and computer program product.

[0006] According to one aspect of the present disclosure, a method for assessing the risk of user information security is provided, comprising: obtaining first page data of a first page of a target application, wherein the first page is used to display a privacy policy describing a user information list of the target application, and the first page includes at least one first link; processing the first page data using a large model, wherein the large model is used to: filter out at least one second link from the at least one first link, wherein each of the at least one second link indicates a first sub-page for displaying content other than the privacy policy; and extracting associated content of the user information list from the first page data after excluding the at least one second link to obtain an assessment data list; and assessing the degree of information security risk when a user uses the target application according to the assessment data list.

[0007] According to another aspect of the present disclosure, a user information security risk assessment device is provided, comprising: an acquisition module, configured to acquire first page data of a first page of a target application, wherein the first page is used to display a privacy policy describing the target application regarding a user information list, and the first page includes at least one first link; a processing module, configured to process the first page data using a large model, wherein the large model is used to: filter out at least one second link from the at least one first link, wherein each of the at least one second link indicates a first sub-page for displaying content other than the privacy policy; and extract associated content of the user information list from the first page data after excluding the at least one second link to obtain an assessment data list; and an assessment module, configured to assess the degree of information security risk when a user uses the target application based on the assessment data list.

[0008] According to another aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above method.

[0009] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the above method.

[0010] According to another aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein the computer program implements the above method when executed by a processor.

[0011] According to one or more embodiments of the present disclosure, a method for risk assessment of user information security is provided, which uses a large model to process page data of an application privacy policy display page based on two levels to extract a user information list and assess the risk level of user information security based on the user information list.

[0012] Specifically, the privacy policy display page usually includes links to the associated privacy policy details page and links to the associated non-privacy policy details page. The large model first identifies and excludes the links to the associated non-privacy policy details page, and obtains the privacy policy page data that only includes links to the associated privacy policy details page, and then extracts the user information list from it, thereby avoiding wasting resources to process the content in irrelevant link details pages, effectively reducing the scale of data processed by the large model, greatly reducing the probability of missed or misjudgment in semantic recognition, and improving the reliability of the final risk assessment results.

[0013] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings exemplarily illustrate the embodiments and constitute a part of the specification, and together with the text description of the specification, are used to explain the exemplary implementation of the embodiments. The embodiments shown are for illustrative purposes only and do not limit the scope of the claims. In all drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0015] Figure 1 is a schematic diagram illustrating an example system in which the various methods described herein may be implemented according to an exemplary embodiment;

[0016] Figure 2 A flowchart of a method for risk assessment of user information security according to an embodiment of the present disclosure is shown;

[0017] Figure 3a and Figure 3b Schematic diagrams of two first pages for displaying a privacy policy describing a target application program regarding a user information list according to an embodiment of the present disclosure are respectively shown;

[0018] Figure 4 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown;

[0019] Figure 5 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown;

[0020] Figure 6 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown;

[0021] Figure 7 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown.

[0022] Figure 8 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown;

[0023] Fig. 9 A structural block diagram of a user information security risk assessment device according to an embodiment of the present disclosure is shown; and

[0024] Fig.10 A structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0025] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0026] In the present disclosure, unless otherwise specified, the use of the terms "first", "second", etc. to describe various elements is not intended to limit the positional relationship, temporal relationship, or importance relationship of these elements, and such terms are only used to distinguish one element from another element. In some examples, the first element and the second element may refer to the same instance of the element, and in some cases, based on the description of the context, they may also refer to different instances.

[0027] The terms used in the description of various examples in this disclosure are only for the purpose of describing specific examples and are not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the element can be one or more. In addition, the term "and / or" used in this disclosure covers any one of the listed items and all possible combinations.

[0028] In the related art, it is proposed that semantic recognition can be performed on the content in the application privacy policy page to determine a list of user information that may be involved in the use of the application, thereby determining the degree of information security risk when the user uses the application based on the aforementioned user information list.

[0029] However, the privacy policy page of an application usually includes a lot of content that is not related to the privacy policy. Therefore, this method of directly performing semantic recognition on the entire privacy policy page not only consumes a lot of model resources, but also the accuracy of the semantic recognition results is not high, which will make the final risk assessment results unreliable.

[0030] To solve the above problems, the present disclosure provides a user information security risk assessment method, which uses a large model to process the page data of the application privacy policy display page based on two levels to extract the user information list and assess the risk level of user information security based on the user information list.

[0031] Specifically, the privacy policy display page usually includes links to the associated privacy policy details page and links to the associated non-privacy policy details page. The large model first identifies and excludes the links to the associated non-privacy policy details page, and obtains the privacy policy page data that only includes links to the associated privacy policy details page, and then extracts the user information list from it, thereby avoiding wasting resources to process the content in irrelevant link details pages, effectively reducing the scale of data processed by the large model, greatly reducing the probability of missed or misjudgment in semantic recognition, and improving the reliability of the final risk assessment results.

[0032] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0033] Figure 1 FIG. 1 is a schematic diagram of an exemplary system 100 in which various methods and apparatuses described herein may be implemented according to an embodiment of the present disclosure. Figure 1 , the system 100 includes one or more client devices 101, 102, 103, 104, 105, and 106, a server 120, and one or more communication networks 110 coupling the one or more client devices to the server 120. The client devices 101, 102, 103, 104, 105, and 106 may be configured to execute one or more applications.

[0034] In an embodiment of the present disclosure, the server 120 may run one or more services or software applications that enable execution of a risk assessment method for user information security.

[0035] In some embodiments, server 120 may also provide other services or software applications that may include non-virtualized environments and virtualized environments. In some embodiments, these services may be provided as web-based services or cloud services, such as provided to users of client devices 101, 102, 103, 104, 105, and / or 106 under a software as a service (SaaS) model.

[0036] exist Figure 1 In the configuration shown, the server 120 may include one or more components that implement the functions performed by the server 120. These components may include software components, hardware components, or a combination thereof that can be executed by one or more processors. Users operating client devices 101, 102, 103, 104, 105, and / or 106 may in turn utilize one or more client applications to interact with the server 120 to utilize the services provided by these components. It should be understood that a variety of different system configurations are possible, which may differ from the system 100. Therefore, Figure 1 is an example of a system for implementing the risk assessment method for user information security described herein and is not intended to be limiting.

[0037] The user may use client devices 101, 102, 103, 104, 105 and / or 106 to perform the risk assessment method for user information security. The client device may provide an interface that enables the user of the client device to interact with the client device. The client device may also output information to the user via the interface. Figure 1 Only six client devices are depicted, but one skilled in the art will appreciate that the present disclosure may support any number of client devices.

[0038] Client devices 101, 102, 103, 104, 105 and / or 106 may include various types of computer devices, such as portable handheld devices, general-purpose computers (such as personal computers and laptop computers), workstation computers, wearable devices, smart screen devices, self-service terminal devices, service robots, game systems, thin clients, various messaging devices, sensors or other sensing devices, etc. These computer devices may run various types and versions of software applications and operating systems, such as MICROSOFT Windows, APPLE iOS, UNIX-like operating systems, Linux or Linux-like operating systems (such as GOOGLE Chrome OS); or include various mobile operating systems, such as MICROSOFT Windows Mobile OS, iOS, Windows Phone, Android. Portable handheld devices may include cellular phones, smart phones, tablet computers, personal digital assistants (PDAs), etc. Wearable devices may include head-mounted displays (such as smart glasses) and other devices. Game systems may include various handheld game devices, Internet-enabled game devices, etc. Client devices are capable of executing various different applications, such as various Internet-related applications, communication applications (such as email applications), short message service (SMS) applications, and may use various communication protocols.

[0039] The network 110 may be any type of network known to those skilled in the art that may support data communications using any of a variety of available protocols, including but not limited to TCP / IP, SNA, IPX, etc. By way of example only, the one or more networks 110 may be a local area network (LAN), an Ethernet-based network, a token ring, a wide area network (WAN), the Internet, a virtual network, a virtual private network (VPN), an intranet, an extranet, a public switched telephone network (PSTN), an infrared network, a wireless network (e.g., Bluetooth, WIFI), and / or any combination of these and / or other networks.

[0040] Server 120 may include one or more general purpose computers, dedicated server computers (e.g., PC (personal computer) servers, UNIX servers, mid-range servers), blade servers, mainframe computers, server clusters, or any other suitable arrangement and / or combination. Server 120 may include one or more virtual machines running virtual operating systems, or other computing architectures involving virtualization (e.g., one or more flexible pools of logical storage devices that may be virtualized to maintain a server's virtual storage device). In various embodiments, server 120 may run one or more services or software applications that provide the functionality described below.

[0041] The computing units in the server 120 may run one or more operating systems including any of the above operating systems and any commercially available server operating systems. The server 120 may also run any of a variety of additional server applications and / or middle-tier applications, including HTTP servers, FTP servers, CGI servers, JAVA servers, database servers, etc.

[0042] In some implementations, server 120 may include one or more applications to analyze and consolidate data feeds and / or event updates received from users of client devices 101, 102, 103, 104, 105, and 106. Server 120 may also include one or more applications to display data feeds and / or real-time events via one or more display devices of client devices 101, 102, 103, 104, 105, and 106.

[0043] In some embodiments, the server 120 may be a server of a distributed system, or a server combined with a blockchain. The server 120 may also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology. A cloud server is a host product in a cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

[0044] The system 100 may also include one or more databases 130. In some embodiments, these databases may be used to store user information lists and other information. For example, one or more of the databases 130 may be used to store privacy policy data and large model weight parameter information such as applications. The databases 130 may reside in various locations. For example, the database used by the server 120 may be local to the server 120, or may be remote from the server 120 and may communicate with the server 120 via a network-based or dedicated connection. The databases 130 may be of different types. In some embodiments, the database used by the server 120 may be, for example, a relational database. One or more of these databases may store, update, and retrieve data to and from the database in response to commands.

[0045] In some embodiments, one or more of the databases 130 may also be used by applications to store application data. The databases used by the applications may be different types of databases, such as a key-value store, an object store, or a conventional store backed by a file system.

[0046] Figure 1 The system 100 may be configured and operated in various ways to enable the application of various methods and apparatuses described in the present disclosure.

[0047] Figure 2 A flow chart of a method for risk assessment of user information security according to an embodiment of the present disclosure is shown.

[0048] like Figure 2 As shown, the user information security risk assessment method 200 includes:

[0049] Step 210: Acquire first page data of a first page of a target application, wherein the first page is used to display a privacy policy describing a user information list of the target application, and the first page includes at least one first link;

[0050] Step 220: Use the large model to process the first page data, wherein the large model is used to perform the following steps:

[0051] Step 221: Filter out at least one second link from at least one first link, wherein each second link in the at least one second link indicates a first sub-page for displaying other content except the privacy policy; and

[0052] Step 222: extracting the associated content of the user information list from the first page data after excluding the at least one second link to obtain an evaluation data list; and

[0053] Step 230: Evaluate the information security risk level of the user when using the target application according to the evaluation data list.

[0054] Therefore, the page data of the application privacy policy display page is processed based on two levels by using a large model to extract the user information list and evaluate the risk level of user information security based on the user information list.

[0055] Specifically, the privacy policy display page usually includes links to the associated privacy policy details page and links to the associated non-privacy policy details page. The large model first identifies the links to the associated non-privacy policy details page and excludes them, and obtains the privacy policy page data that only includes links to the associated privacy policy details page, and then extracts the user information list from it, thereby avoiding wasting resources to process the content in irrelevant link details pages and effectively reducing the scale of data processed by the large model.

[0056] In addition, the privacy policy text is not a structured standard format file. The specific descriptions of the same type of user information between different applications are often quite different, which makes it difficult to identify. The irrelevant links in the privacy policy page (or the large amount of irrelevant data obtained from the details page of the irrelevant link) further exacerbate this difficulty. By excluding irrelevant links, the privacy policy data used for semantic recognition can be effectively simplified, and the omissions or misjudgments in the subsequent extraction of the user information list can be avoided as much as possible, thereby improving the reliability of the final risk assessment results.

[0057] In step 210 , illustratively, the first page data may be a program of the first page 300 (eg, a program based on a programming language such as HTML, Java, JavaScript, Kotlin, and Swift).

[0058] In one example, for the first page dynamically generated by Java Script, the user's operation process can be simulated by using a cloud phone, so that for each third link in the first page, the user can click on it to enter the details page and obtain the specific content of the associated privacy policy.

[0059] In another example, for other types of first pages, corresponding first page data may also be obtained by using a headless browser or the like.

[0060] Figure 3a and Figure 3b Schematic diagrams of two first pages for displaying a privacy policy describing a target application program regarding a user information list according to an embodiment of the present disclosure are respectively shown.

[0061] Here Figure 3a and Figure 3bThe method 200 of the present disclosure is specifically described using the example, but it should be understood that the method 200 is not limited thereto.

[0062] In one example, if Figure 3a As shown, for step 210, the first page 301 can be a web page that is jumped to after clicking the corresponding privacy policy button in the target application. The target application can be, for example, an educational application "XX Classroom". The first page 301 includes at least one link (such as Figure 3a The position shown in the box).

[0063] For steps 221 and 222 in step 220, the first page data is input into the big model for understanding, so that the big model can filter out links 320 associated with non-privacy policy details pages (for example, "Courses" and "About Us") from the first page 301 and exclude them from the first page 301 to extract a user information list based on the first page data that only includes links 310 associated with privacy policy details pages (for example, "How we collect personal information" and "How we share, transfer, and publicly disclose personal information") and remaining non-link content (for example, "This version of the privacy policy was published on...").

[0064] In one example, the link 310 associated with the privacy policy details page in the first page 301 may include two forms. Figure 3a , in the box corresponding to the link 310, an underline is used to mark the specific link location for the user to click to view the details page. It can be seen that for the first type of link 310, the user can directly click the text description to view the details page (for example, "How we collect personal information"), and for the second type of link 310, the user views the details page by clicking a specific URL (Uniform Resource Locator) address (for example, "http: / / ..."), and the text before and after the URL address is used to specifically describe the content of the details page indicated by the link.

[0065] In another example, Figure 3b As shown, the first page 302 of the target application can also be a page that can be viewed directly in the target application to display a privacy policy describing a list of user information. The first page 302 includes a link 330 associated with a privacy policy detail page (e.g., "Privacy Policy" and "Personal Information Collection List") and a link 340 associated with a non-privacy policy detail page (e.g., "Account Information" and "Playback Settings"). The processing flow for the first page 302 is similar to the processing flow for the first page 301 described above, and will not be repeated here.

[0066] For step 230, the evaluation data list can be compared with the list of user information involved in the actual use of the target application to determine the degree of transparency of the target application in informing users of the user information that may be collected and / or used, and the degree of risk to user information security can be determined based on the above degree of transparency.

[0067] In one example, an evaluation data list can be extracted based on multiple applications, and different terms indicating the same user information type in the evaluation data list can be associated with the standard terms of the same user information type, so that the user information in the extracted evaluation data list can be better determined and compared with the actual behavior of the target application (for example, the user information permissions applied for, etc.).

[0068] Figure 4 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown.

[0069] According to some embodiments, Figure 4 As shown, step 221 includes:

[0070] Step 410: for each first link in at least one first link,

[0071] Step 411: Determine the context information corresponding to the first link according to the position of the first link in the first page;

[0072] Step 412: Determine whether the first link indicates a first sub-page according to the context information; and

[0073] Step 413: in response to determining that the first link indicates the first subpage, use the first link as the second link; and

[0074] Step 420: traverse at least one first link to obtain at least one second link.

[0075] The context information of each link in the first page is usually highly correlated with the content of the details page indicated by the link. Therefore, in the first-level processing process, it is only necessary to understand part of the data of the first page (the context information corresponding to each first link) in a targeted manner to more accurately filter out the second link. Compared with clicking the first link to enter the details page and then extracting the specific content for identification, the processing difficulty is greatly reduced and costs are saved.

[0076] For step 411, in one example, the first page data is an HTML program, and the position of each first link can be determined according to the attribute tag indicating the link in the HTML, and the attribute tag indicating the link can be, for example, herf, target, rel, download, and id, etc. Similarly, for programming programs based on other languages, the position of each first link can also be determined based on the corresponding tag, which will not be described in detail.

[0077] In another example, the location of each first link may be determined based on key characters, such as “http”, “www”, “.cn”, and “.com”.

[0078] According to some embodiments, step 412 includes: using a first number of text paragraphs above the first link and / or a second number of text paragraphs below the first link as context information.

[0079] Compared with sentences and words, the semantic logic and semantic information included in paragraphs are usually more complete. Therefore, using paragraphs as the basic unit to obtain the corresponding context information of the first link can more accurately determine whether the details page indicated by the first link is related to the privacy policy.

[0080] In one example, in the case where the first page data is an HTML program, after determining the location of the first link, the location of the first link can be determined based on the continuation paragraph attribute tag (for example, Tag) determines the context information corresponding to the first link.

[0081] It should be noted that, for a first link that uses a text description instead of a URL address for display, the text description used to replace the URL address can also be used as the context information corresponding to the first link to further improve the recognition accuracy. For example, the program content corresponding to the first link is "<ahref="http: / / ……"> The personal information we collect”, then the “personal information we collect” after “http: / / …” can be used as at least part of the following information.

[0082] For example, see Figure 3a In the box corresponding to the link 310 associated with the privacy policy details page, for the link "Personal information we collect", the contextual information can be, for example, at least part of the "This version of the privacy policy was published on..." above, the "Personal information we collect" itself, and the "III. Third-party list..." below. Figure 3b The situation in is similar.

[0083] Exemplarily, the first number and the second number may be the same or different, and the first number and the second number may be, for example, 1, 2, 3 or 5.

[0084] Figure 5 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown.

[0085] like Figure 5 As shown, according to some embodiments, in response to the first page data including text data describing at least part of the privacy policy, step 222 includes:

[0086] Step 510, extracting a first portion associated with the user information list from the text data; and

[0087] Step 520: Add the first part to the evaluation data list.

[0088] See also Figure 3a , in the example, Figure 3a In the "III. Third-party list" section, there is text data describing the user information list shared with the third-party SDK. Therefore, the related content can be extracted from the text data and added to the assessment data list to improve the data completeness of the assessment data list, thereby improving the reliability of the final risk assessment results.

[0089] Figure 6 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown.

[0090] According to some embodiments, Figure 6 As shown, for step 410 in step 221, after step 412, the following further includes: step 6413, in response to determining that the first link indicates a second sub-page for displaying at least part of the privacy policy, using the first link as a third link;

[0091] The method 200 includes: step 6430, traversing at least one first link to obtain at least one third link;

[0092] And, step 222 includes:

[0093] Step 6221: extracting a second part associated with the user information list from at least one second subpage corresponding to at least one third link; and

[0094] Step 6222, add the second part to the evaluation data list.

[0095] By traversing and determining all third links, it is possible to specifically obtain the content related to at least part of the privacy policy in the details page indicated by each third link, and perform semantic recognition based on the obtained content, so as to extract part of the evaluation data of the associated user information list and add it to the evaluation data list, thereby further ensuring the data completeness of the extracted evaluation data list, thereby improving the reliability of the final risk assessment results.

[0096] According to some embodiments, the first user information list includes first type of user information associated with the target application itself and second type of user information associated with a third-party application.

[0097] For example, see Figure 3a The first category of user information may, for example, correspond to the user information described in the details page indicated by the link "I. Personal information we collect", and the second category of user information may, for example, correspond to the user information under "III. Third-party list".

[0098] Figure 7 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown.

[0099] According to some embodiments, the second category of user information includes a first tag and a second tag, the first tag indicating the name of the third-party application associated with the second category of user information, and the second tag indicating the purpose of use, usage scenario, information type and associated link of the second category of user information.

[0100] And, if Figure 7 As shown, step 222 includes:

[0101] Step 710: in response to the first page data after excluding at least one second link including at least one first table, obtaining a first table header of each first table in the at least one first table to obtain at least one first table header;

[0102] Step 720: Filter out a second header associated with the first tag from the at least one first header to obtain at least one second header;

[0103] Step 730: based on the second tag, extract corresponding second-category user information from at least one first table corresponding to at least one second table header to obtain at least one second-category user information; and

[0104] Step 740: Add at least one second category of user information to the evaluation data list.

[0105] In the privacy policy, the second category of user information is usually more structured than the first category of user information. Specifically, in order to comply with regulations, the second category of user information usually needs to include five elements: name (i.e., first label), purpose of use, usage scenario, information type, and associated links (i.e., second label), and such user information is usually disclosed in a table. Therefore, the second category of user information can be identified and extracted from the table on the first page first, thereby improving processing efficiency and reducing processing difficulty.

[0106] For example, see Figure 3a , the second table may correspond to Figure 3a The second table shows that the target application "XX Classroom" will share "BB" category user information with the third-party application "AA", and each row in the second table includes at least one element in the second tag corresponding to the "BB" category user information.

[0107] It should be noted that Figure 3a The table shown in connection with the "BB" category user information is for illustrative purposes only. Figure 3a Also omitted from the section are tables associated with other categories of user information and tables that are not associated with the Privacy Policy.

[0108] Exemplarily, the table header (ie, the first row in the first table) usually displays the name of the third-party application, so the name can be extracted from the table header as the first label to determine that the first table is the second table (associated with the second type of user information).

[0109] For step 710 and step 720, in one example, for the first page data of the html program type, the (Table Attributes Tag) Determine the location of each first table in the first page data, and based on In the Properties tab (Header attribute tag) Determine the header of the first table so as to perform filtering.

[0110] With respect to step 730 and step 740 , for the second table obtained through screening, the corresponding second category of user information can be extracted by parsing the table based on the second tag.

[0111] Figure 8 A partial flow chart of another method for risk assessment of user information security according to an embodiment of the present disclosure is shown.

[0112] According to some embodiments, Figure 8 As shown, step 222 also includes:

[0113] Step 810: extract at least one second type of user information from the first page data after excluding the first table and at least one second link as the user information to be processed, and obtain at least one user information to be processed;

[0114] Step 820: for each piece of user information to be processed in at least one piece of user information to be processed,

[0115] Step 821: determine whether the extracted second tag of the user information to be processed is complete; and

[0116] Step 822: In response to determining that at least one element of the purpose of use, the scenario of use, the type of information, and the associated link is missing from the second tag of the user information to be processed, extracting the element in the corresponding second tag that is missing from the user information to be processed from the first page data by using a vector recall method, so as to update the user information to be processed; and

[0117] Step 830: traverse at least one piece of user information to be processed, and add the updated at least one piece of user information to be processed to the evaluation data list.

[0118] The second category of user information may also be presented in a non-tabular form. However, the probability of missed and misjudgment in the second category of user information extracted from the non-tabular part through semantic recognition is higher than that directly extracted from the tabular part.

[0119] Therefore, based on the structured characteristics of the second category of user information, the five elements mentioned above can be used to verify whether the extracted second category of user information is complete for the second category of user information extracted from the non-tabular part, and vector recall can be performed for the second category of user information that is missing any element, thereby further improving the completeness and accuracy of the obtained evaluation data list.

[0120] According to some embodiments, the privacy policy includes a full version of the privacy policy and an abridged version of the privacy policy, and method 200 further includes: in response to determining that the first page is used to display the abridged version of the privacy policy, obtaining second page data of a second page for displaying the full version of the privacy policy to update the first page data.

[0121] Exemplarily, the privacy policy of the target application may include a full version and an abridged version (e.g., a children's version, a simplified version, or a summary version), and only the first page of the full version of the privacy policy is used to extract the user information list to ensure the completeness of the extracted user information list and reduce resource costs.

[0122] In one example, the title of the privacy policy may be identified to determine the specific version of the privacy policy.

[0123] According to some embodiments, method 200 further includes: returning the first page data and the evaluation data list as training data to the large model for training, so as to update the model parameters of the large model.

[0124] Since there is no uniform industry standard for the terms in an application's privacy policy, returning the first page data and the evaluation data list to the big model for retraining can enable the big model to better establish the association between the specific terms in the privacy policy and the corresponding types of user information, thereby improving the overall performance of the big model.

[0125] Fig. 9 A structural block diagram of a risk assessment device for user information security according to an embodiment of the present disclosure is shown.

[0126] According to another aspect of the present disclosure, a risk assessment device for user information security is provided. Fig. 9 As shown, the user information security risk assessment device 900 includes: an acquisition module 910, configured to acquire first page data of a first page of a target application, wherein the first page is used to display a privacy policy describing the target application regarding a user information list, and the first page includes at least one first link; a processing module 920, configured to process the first page data using a large model, wherein the large model is used to: filter out at least one second link from at least one first link, wherein each second link in the at least one second link indicates a first sub-page for displaying content other than the privacy policy; and extract associated content of the user information list from the first page data after excluding at least one second link to obtain an evaluation data list; and an evaluation module 930, configured to evaluate the degree of information security risk when a user uses the target application according to the evaluation data list.

[0127] According to another aspect of the present disclosure, an electronic device is also provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the aforementioned method.

[0128] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is further provided, wherein the computer instructions are used to enable the computer to execute the aforementioned method.

[0129] According to another aspect of the present disclosure, a computer program product is also provided, including a computer program, wherein the computer program implements the aforementioned method when executed by a processor.

[0130] like Fig.10 As shown, the electronic device 1000 includes a computing unit 1001, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1002 or a computer program loaded from a storage unit 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the electronic device 1000 can also be stored. The computing unit 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0131] Multiple components in the electronic device 1000 are connected to the I / O interface 1005, including: an input unit 1006, an output unit 1007, a storage unit 1008 and a communication unit 1009. The input unit 1006 can be any type of device that can input information to the electronic device 1000. The input unit 1006 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device, and can include but is not limited to a mouse, a keyboard, a touch screen, a trackpad, a trackball, a joystick, a microphone and / or a remote control. The output unit 1007 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator and / or a printer. The storage unit 1008 can include but is not limited to a disk and an optical disk. The communication unit 1009 allows the electronic device 1000 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver and / or a chipset, such as Bluetooth TM devices, 802.11 devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0132] The computing unit 1001 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1001 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1001 performs the various methods and processes described above, such as a matrix calculation method based on a GPU. For example, in some embodiments, a matrix calculation method based on a GPU may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 1008. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 1000 via the ROM 1002 and / or the communication unit 1009. When the computer program is loaded into the RAM 1003 and executed by the computing unit 1001, one or more steps of the matrix calculation method based on the GPU described above may be performed. Alternatively, in other embodiments, the computing unit 1001 may be configured to execute a GPU-based matrix calculation method in any other appropriate manner (eg, by means of firmware).

[0133] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0134] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0135] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0136] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0137] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0138] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0139] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0140] Although the embodiments or examples of the present disclosure have been described with reference to the accompanying drawings, it should be understood that the above-mentioned methods, systems and devices are merely exemplary embodiments or examples, and the scope of the present invention is not limited by these embodiments or examples, but only by the claims after authorization and their equivalent scope. Various elements in the embodiments or examples can be omitted or replaced by their equivalent elements. In addition, each step can be performed in an order different from that described in the present disclosure. Further, the various elements in the embodiments or examples can be combined in various ways. It is important that with the evolution of technology, many elements described herein can be replaced by equivalent elements that appear after the present disclosure.

Claims

1. A user information security risk assessment method, comprising: Acquire first page data of a first page of a target application, wherein the first page is used to display a privacy policy describing a user information list of the target application, and the first page includes at least one first link; The first page data is processed using a large model, wherein the large model is used to: Filtering at least one second link from the at least one first link, wherein each of the at least one second link indicates a first sub-page for displaying content other than the privacy policy; and Extracting the associated content of the user information list from the first page data after excluding the at least one second link to obtain an evaluation data list; and The information security risk level when the user uses the target application is evaluated according to the evaluation data list.

2. The method according to claim 1, wherein: The step of selecting at least one second link from the at least one first link comprises: For each first link of the at least one first link, Determining context information corresponding to the first link according to the position of the first link in the first page; Determining whether the first link indicates the first sub-page according to the context information; and In response to determining that the first link indicates the first sub-page, using the first link as the second link; and The at least one first link is traversed to obtain the at least one second link.

3. The method according to claim 2, wherein: The determining the context information corresponding to the first link according to the position of the first link in the first page includes: A first number of text paragraphs above the first link and / or a second number of text paragraphs below the first link are used as the context information.

4. The method according to any one of claims 1 to 3, wherein: In response to the first page data including text data describing at least part of the privacy policy, extracting the associated content of the user information list from the first page data after excluding the at least one second link to obtain the evaluation data list includes: extracting a first portion associated with the user information list from the text data; and The first part is added to the evaluation data list.

5. The method according to claim 2 or 3, wherein: After determining whether the first link indicates the first sub-page according to the context information, the method further includes: In response to determining that the first link indicates a second subpage for displaying at least a portion of the privacy policy, using the first link as a third link; Wherein, the method further comprises: Traversing the at least one first link to obtain at least one third link; And wherein, extracting the associated content of the user information list from the first page data after excluding the at least one second link to obtain the evaluation data list includes: Extracting a second part associated with the user information list from at least one second sub-page corresponding to the at least one third link; and The second part is added to the evaluation data list.

6. The method according to any one of claims 1 to 5, wherein: The first user information list includes first type of user information associated with the target application itself and second type of user information associated with a third-party application.

7. The method according to claim 6, wherein: The second category of user information includes a first tag and a second tag, wherein the first tag indicates the name of a third-party application associated with the second category of user information, and the second tag indicates the purpose of use, usage scenario, information type and associated link of the second category of user information. And wherein, extracting the associated content of the user information list from the first page data after excluding the at least one second link to obtain the evaluation data list includes: In response to the first page data after excluding the at least one second link including at least one first table, acquiring a first table header of each first table in the at least one first table to obtain at least one first table header; Filtering a second header associated with the first tag from the at least one first header to obtain at least one second header; Based on the second tag, extract corresponding second-category user information from at least one first table corresponding to the at least one second table header to obtain at least one second-category user information; and The at least one second category of user information is added to the evaluation data list.

8. The method according to claim 7, wherein the step of extracting the associated content of the user information list from the first page data after excluding the at least one second link to obtain the evaluation data list further comprises: Extract at least one second type of user information from the first page data after excluding the first table and the at least one second link as the user information to be processed, to obtain at least one user information to be processed; For each piece of user information to be processed in the at least one piece of user information to be processed, Determine whether the extracted second tag of the user information to be processed is complete; as well as In response to determining that at least one element among the usage purpose, usage scenario, information type and associated link is missing in the second tag of the user information to be processed, extracting the element in the corresponding second tag that is missing from the user information to be processed from the first page data by using a vector recall method, so as to update the user information to be processed; as well as The at least one piece of user information to be processed is traversed, and the updated at least one piece of user information to be processed is added to the evaluation data list.

9. The method according to any one of claims 1 to 8, wherein: The privacy policy includes a full version of the privacy policy and an abridged version of the privacy policy, and the method further includes: In response to determining that the first page is used to display the abridged version of the privacy policy, second page data of a second page used to display the full version of the privacy policy is obtained to update the first page data.

10. The method according to any one of claims 1 to 9, further comprising: The first page data and the evaluation data list are returned to the large model as training data for training to update the model parameters of the large model.

11. A risk assessment device for user information security, comprising: an acquisition module configured to acquire first page data of a first page of a target application, wherein the first page is used to display a privacy policy describing a user information list of the target application, and the first page includes at least one first link; A processing module is configured to process the first page data using a large model, wherein the large model is used to: Filtering at least one second link from the at least one first link, wherein each of the at least one second link indicates a first sub-page for displaying content other than the privacy policy; and Extracting the associated content of the user information list from the first page data after excluding the at least one second link to obtain an evaluation data list; and The evaluation module is configured to evaluate the information security risk level of the user when using the target application according to the evaluation data list.

12. The device according to claim 11, wherein The processing module is further configured to: For each first link of the at least one first link, Determining context information corresponding to the first link according to the position of the first link in the first page; Determining, according to the context information, whether the first link indicates the first sub-page; as well as In response to determining that the first link indicates the first sub-page, using the first link as the second link; as well as The at least one first link is traversed to obtain the at least one second link.

13. The device according to claim 12, wherein: The determining the context information corresponding to the first link according to the position of the first link in the first page includes: A first number of text paragraphs above the first link and / or a second number of text paragraphs below the first link are used as the context information.

14. The device according to any one of claims 11 to 13, wherein: In response to the first page data including text data describing at least part of the privacy policy, the processing module is further configured to: extracting a first portion associated with the user information list from the text data; and The first part is added to the evaluation data list.

15. The device according to claim 12 or 13, wherein: After determining whether the first link indicates the first sub-page according to the context information, the method further includes: In response to determining that the first link indicates a second subpage for displaying at least a portion of the privacy policy, using the first link as a third link; Wherein, the processing module is further configured as follows: Traversing the at least one first link to obtain at least one third link; Extracting a second part associated with the user information list from at least one second sub-page corresponding to the at least one third link; and The second part is added to the evaluation data list.

16. The device according to any one of claims 11 to 15, wherein: The first user information list includes first type of user information associated with the target application itself and second type of user information associated with a third-party application.

17. The device according to claim 16, wherein: The second category of user information includes a first tag and a second tag, wherein the first tag indicates the name of a third-party application associated with the second category of user information, and the second tag indicates the purpose of use, usage scenario, information type and associated link of the second category of user information. And wherein, the processing module is further configured to: In response to the first page data after excluding the at least one second link including at least one first table, acquiring a first table header of each first table in the at least one first table to obtain at least one first table header; Filtering a second header associated with the first tag from the at least one first header to obtain at least one second header; Based on the second tag, extract corresponding second-category user information from at least one first table corresponding to the at least one second table header to obtain at least one second-category user information; and The at least one second category of user information is added to the evaluation data list.

18. The apparatus according to claim 17, wherein the processing module is further configured to: Extract at least one second type of user information from the first page data after excluding the first table and the at least one second link as the user information to be processed, to obtain at least one user information to be processed; For each piece of user information to be processed in the at least one piece of user information to be processed, Determine whether the extracted second tag of the user information to be processed is complete; as well as In response to determining that at least one element among the usage purpose, usage scenario, information type and associated link is missing in the second tag of the user information to be processed, extracting the element in the corresponding second tag that is missing from the user information to be processed from the first page data by using a vector recall method, so as to update the user information to be processed; as well as The at least one piece of user information to be processed is traversed, and the updated at least one piece of user information to be processed is added to the evaluation data list.

19. The device according to any one of claims 11 to 18, wherein: The privacy policy includes a full version of the privacy policy and an abridged version of the privacy policy, and the device also includes: The judgment module is configured to, in response to determining that the first page is used to display the abridged version of the privacy policy, obtain second page data of a second page for displaying the full version of the privacy policy to update the first page data.

20. The apparatus according to any one of claims 11 to 19, further comprising: The updating module is configured to return the first page data and the evaluation data list as training data to the large model for training, so as to update the model parameters of the large model.

21. An electronic device comprising: at least one processor; as well as a memory communicatively coupled to the at least one processor; in The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 10.

22. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-10.

23. A computer program product comprising a computer program, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images