A method and system for discovering virtual communities of network pollution based on association graph completion

Abstract

This application discloses a method and system for discovering virtual communities of network nuisances based on association graph completion, belonging to the field of network security technology. The method includes acquiring network nuisance sites and extracting the asset attributes of each site; analyzing the technical routes of the sites and the implementation methods of the technical nodes within each route; constructing a network nuisance association graph; determining the similarity between nodes of the sites, dividing the set of sites into several subsets, and establishing an association subgraph for each subset; converting the association subgraph into a directed acyclic graph (DAG); and determining the behavioral patterns of the virtual communities of network nuisances corresponding to the DAG. This application demonstrates good technical effectiveness in discovering hidden assets and behavioral patterns of network nuisances.

Description

Technical Field

[0001] This application belongs to the field of network security technology, and in particular relates to a method and system for discovering virtual communities of network pollution based on association graph completion. Background Technology

[0002] Current methods for detecting virtual communities that pose a threat to online order primarily focus on locating the virtual communities where these threats operate, aiming to combat and control them at their source. However, these virtual communities conceal themselves by using methods such as changing website templates, renting cloud servers, and dynamically loading websites, making their detection extremely difficult. Summary of the Invention

[0003] This application provides a method and system for discovering virtual communities that combat online content dissemination-related cybercrime, aiming to solve or at least partially solve the aforementioned problems. While identifying the hidden assets and behavioral patterns of these cybercrime virtual communities, the system automatically discovers the corresponding virtual communities, providing support for the analysis and governance of such communities.

[0004] The first aspect of this application proposes a method for discovering virtual communities of network pollution based on association graph completion, the method comprising:

[0005] Step S1: The network nuisance site attribute parsing module obtains network nuisance sites, extracts the asset attributes of each network nuisance site, the asset attributes include domain name, IP address, and web page content, treats each network nuisance site as a network nuisance site node, constructs a network nuisance site set, and each network nuisance site node is an element in the network nuisance site set; the network nuisance site refers to a network nuisance website that includes corresponding domain names, IP addresses, and web page content at the same time;

[0006] Step S2: The network pollution technology and tactics analysis module collects certified network pollution research reports, analyzes the technical routes of network pollution and the implementation methods of the technical nodes in each technical route; wherein, the technical nodes are connected to form a technical route, and each technical node corresponds to one or more implementation methods;

[0007] Step S3: The network pollution association graph construction module uses a large language model to map the webpage content of each network pollution site node to its corresponding implementation method. The implementation method corresponding to each network pollution site node is added as a new attribute of that network pollution site node. Each network pollution site node corresponds to one or more implementation methods. A network pollution association graph G = (V, E) is constructed, where V is the set of network pollution sites, and E is an ordered pair (v...). i ,v j The set of ) represents the network pollution site nodes from vi to v in V.j The redirection relationship is determined based on the IP address of the network public site node and the webpage content attributes;

[0008] Step S4: The network public nuisance gang association graph completion module determines the similarity between network public nuisance site nodes based on the attributes of the network public nuisance site nodes, divides the network public nuisance site set into several subsets, establishes an association subgraph for each subset, and constructs the association subgraph based on the edges in the network public nuisance association graph. The network public nuisance site nodes corresponding to the association subgraph form a network public nuisance virtual community.

[0009] For each associated subgraph: based on the order of each technical node in the technical route and the implementation means corresponding to each network pollution site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior pattern of the network pollution virtual community corresponding to the associated subgraph is determined.

[0010] Preferably, the method for discovering virtual communities for content-related online nuisances further includes: step S5: identifying online nuisance site nodes whose behavioral patterns are more than a preset threshold similar to the behavioral patterns of the online nuisance virtual community as associated online nuisance site nodes of the online nuisance virtual community; and performing behavioral pattern mining on the online nuisance virtual community and associated online nuisance site nodes to determine the hidden behavioral patterns of the online nuisance virtual community.

[0011] Preferably, in step S4, the network nuisance gang association graph completion module determines the similarity between network nuisance site nodes based on the attributes of the network nuisance site nodes, divides the network nuisance site set into several subsets, establishes an association subgraph for each subset, and constructs the association subgraph based on the edges in the network nuisance association graph, including: grouping network nuisance site nodes with domain name similarity greater than a first preset threshold into the same subset; grouping network nuisance site nodes with IP address similarity greater than a second preset threshold into the same subset; and grouping network nuisance site nodes with webpage content similarity greater than a third preset threshold into the same subset.

[0012] For each subset: obtain all network pollution site node pairs in the subset. If there is a directed edge between the network pollution site node pairs in the network pollution association graph, then establish a directed edge between the network pollution site node pairs in the subset; thus forming an association subgraph.

[0013] Preferably, step S4: based on the order of each technical node in the technical route and the implementation means corresponding to each network public nuisance site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior mode of the network public nuisance virtual community corresponding to the associated subgraph is determined, including: determining the technical node corresponding to the implementation means of each network public nuisance site node in the associated subgraph;

[0014] Delete directed edges in the associated subgraph that contradict the order of the technical nodes in the technical route;

[0015] Convert the associated subgraph into a directed acyclic graph;

[0016] Based on the implementation methods corresponding to each network pollution site node in the directed acyclic graph, the behavior pattern corresponding to the associated subgraph is determined, and this behavior pattern is taken as the behavior pattern of the network pollution virtual community corresponding to the associated subgraph.

[0017] Preferably, step S5: identifying network pollution site nodes whose behavioral patterns are more than a preset threshold similar to the behavioral patterns of the network pollution virtual community as associated network pollution site nodes of the network pollution virtual community; performing behavioral pattern mining on the network pollution virtual community and associated network pollution site nodes to determine the hidden behavioral patterns of the network pollution virtual community, including:

[0018] The associated network pollution site nodes are incorporated into the subset corresponding to the network pollution virtual community. An associated subgraph is established for the updated subset, and the associated subgraph corresponding to the updated subset is converted into a directed acyclic graph. Based on the directed acyclic graph, the behavior pattern corresponding to the associated subgraph is determined, and the behavior pattern is used as the hidden behavior pattern of the network pollution virtual community.

[0019] A second aspect of this application proposes a network public nuisance virtual community discovery system based on association graph completion, the system comprising:

[0020] Network nuisance website attribute parsing module: This module acquires network nuisance websites, extracts the asset attributes of each website, including domain name, IP address, and webpage content, and treats each website as a network nuisance website node to construct a network nuisance website set. Each network nuisance website node is an element in the set. A network nuisance website refers to a network nuisance website that simultaneously contains corresponding domain names, IP addresses, and webpage content.

[0021] The Network Pollution Technical and Tactical Analysis Module collects certified network pollution research reports, analyzes the technical routes of network pollution and the implementation methods of the technical nodes in each technical route; among them, technical nodes are connected to form technical routes, and each technical node corresponds to one or more implementation methods;

[0022] Network Pollution Association Graph Construction Module: This module uses a large language model to map the webpage content of each network pollution site node to its corresponding implementation method. The implementation method corresponding to each network pollution site node is added as a new attribute of that node. Each network pollution site node can correspond to one or more implementation methods. The module constructs a network pollution association graph G = (V, E), where V is the set of network pollution sites, and E is an ordered pair (v...). i ,v j The set of () represents the network public nuisance site nodes v in V. i To network public nuisance site node v j The jump relationship is determined based on the IP address and webpage content attributes of the network public nuisance site nodes; the network public nuisance virtual community association graph completion module: based on the attributes of the network public nuisance site nodes, it determines the similarity between the network public nuisance site nodes, divides the network public nuisance site set into several subsets, establishes an association subgraph for each subset, and constructs the association subgraph based on the edges in the network public nuisance association graph. The network public nuisance site nodes corresponding to the association subgraph form a network public nuisance virtual community.

[0023] For each associated subgraph: based on the order of each technical node in the technical route and the implementation means corresponding to each network pollution site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior pattern of the network pollution virtual community corresponding to the associated subgraph is determined.

[0024] A third aspect of this application provides an electronic device, the electronic device comprising:

[0025] At least one processor; and

[0026] A memory communicatively connected to the at least one processor; wherein,

[0027] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described above.

[0028] A fourth aspect of this application provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method described above.

[0029] This application has the following technical effects:

[0030] 1. This application considers the similarity of network pollution asset attributes such as IP address C-segment, site domain name, and web page screenshot information of network pollution sites. It also considers the similarity of network pollution implementation techniques and tactics from a global perspective, thus making this application more advantageous in discovering hidden network pollution assets and behavioral patterns.

[0031] 2. This application introduces external knowledge such as the research report on network pollution, and uses the same language model to represent the research report on network pollution and the content of the network site as vectors. Therefore, the vector spaces of the two have natural consistency, which makes the mapping of the site content of the network pollution node in this application more accurate. Attached Figure Description

[0032] Figure 1 A flowchart illustrating the methods for discovering virtual communities that target online nuisances related to content dissemination;

[0033] Figure 2 A schematic diagram of the architecture for a virtual community discovery method targeting online nuisances related to content dissemination;

[0034] Figure 3 This is a schematic diagram of the structure of a virtual community discovery system for online content dissemination-related public nuisances. Detailed Implementation

[0035] The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0036] like Figure 1-Figure 2 As shown, this application provides a method for discovering virtual communities of network pollution based on association graph completion, the method comprising:

[0037] Step S1: The network nuisance site attribute parsing module obtains network nuisance sites, extracts the asset attributes of each network nuisance site, the asset attributes include domain name, IP address, and web page content, treats each network nuisance site as a network nuisance site node, constructs a network nuisance site set, and each network nuisance site node is an element in the network nuisance site set; the network nuisance site refers to a network nuisance website that includes corresponding domain names, IP addresses, and web page content at the same time;

[0038] Step S2: The network pollution technology and tactics analysis module collects certified network pollution research reports, analyzes the technical routes of network pollution and the implementation methods of the technical nodes in each technical route; wherein, the technical nodes are connected to form a technical route, and each technical node corresponds to one or more implementation methods;

[0039] Step S3: The network pollution association graph construction module uses a large language model to map the webpage content of each network pollution site node to its corresponding implementation method. The implementation method corresponding to each network pollution site node is added as a new attribute of that network pollution site node. Each network pollution site node corresponds to one or more implementation methods. A network pollution association graph G = (V, E) is constructed, where V is the set of network pollution sites, and E is an ordered pair (v...). i ,v j The set of ) represents the network pollution site nodes from vi to v in V. j The redirection relationship is determined based on the IP address of the network public site node and the webpage content attributes;

[0040] Step S4: The network public nuisance gang association graph completion module determines the similarity between network public nuisance site nodes based on the attributes of the network public nuisance site nodes, divides the network public nuisance site set into several subsets, establishes an association subgraph for each subset, and constructs the association subgraph based on the edges in the network public nuisance association graph. The network public nuisance site nodes corresponding to the association subgraph form a network public nuisance virtual community.

[0041] For each associated subgraph: based on the order of each technical node in the technical route and the implementation means corresponding to each network pollution site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior pattern of the network pollution virtual community corresponding to the associated subgraph is determined.

[0042] The method for discovering virtual communities targeting online nuisances related to content dissemination further includes: Step S5: identifying online nuisance site nodes whose behavioral patterns are more than a preset threshold similar to the behavioral patterns of the online nuisance virtual community as associated online nuisance site nodes of the online nuisance virtual community; and performing behavioral pattern mining on the online nuisance virtual community and associated online nuisance site nodes to determine the hidden behavioral patterns of the online nuisance virtual community.

[0043] Further, in step S4, the network nuisance gang association graph completion module determines the similarity between network nuisance site nodes based on the attributes of the network nuisance site nodes, divides the network nuisance site set into several subsets, establishes an association subgraph for each subset, and constructs the association subgraph based on the edges in the network nuisance association graph, including: grouping network nuisance site nodes with domain name similarity greater than a first preset threshold into the same subset; grouping network nuisance site nodes with IP address similarity greater than a second preset threshold into the same subset; and grouping network nuisance site nodes with webpage content similarity greater than a third preset threshold into the same subset.

[0044] For each subset: obtain all network pollution site node pairs in the subset. If there is a directed edge between the network pollution site node pairs in the network pollution association graph, then establish a directed edge between the network pollution site node pairs in the subset; thus forming an association subgraph.

[0045] Step S4: Based on the order of each technical node in the technical route and the implementation means corresponding to each network public nuisance site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior mode of the network public nuisance virtual community corresponding to the associated subgraph is determined, including: determining the technical node corresponding to the implementation means of each network public nuisance site node in the associated subgraph.

[0046] Delete directed edges in the associated subgraph that contradict the order of the technical nodes in the technical route;

[0047] Convert the associated subgraph into a directed acyclic graph;

[0048] Based on the implementation methods corresponding to each network pollution site node in the directed acyclic graph, the behavior pattern corresponding to the associated subgraph is determined, and this behavior pattern is taken as the behavior pattern of the network pollution virtual community corresponding to the associated subgraph.

[0049] Step S5: Network pollution site nodes whose behavioral patterns are more than a preset threshold similar to the behavioral patterns of the network pollution virtual community are identified as associated network pollution site nodes of the network pollution virtual community; behavioral pattern mining is performed on the network pollution virtual community and its associated network pollution site nodes to determine the hidden behavioral patterns of the network pollution virtual community, including:

[0050] The associated network pollution site nodes are incorporated into the subset corresponding to the network pollution virtual community. An associated subgraph is established for the updated subset, and the associated subgraph corresponding to the updated subset is converted into a directed acyclic graph. Based on the directed acyclic graph, the behavior pattern corresponding to the associated subgraph is determined, and the behavior pattern is used as the hidden behavior pattern of the network pollution virtual community.

[0051] This invention provides a specific embodiment of a method for discovering virtual communities of network pollution based on association graph completion. The method includes:

[0052] Step 1: Access network space site data and collect research reports on network public nuisances, such as the "Special Report on Judicial Big Data on the Characteristics and Trends of Information Network Crimes (January 2017 - December 2021)" and the "White Paper on Preventing and Combating Telecommunications Network Fraud in the Information and Communication Industry."

[0053] Step two: Traverse the network space site data, filter out network pollution sites based on existing network pollution identification methods, analyze the asset attributes of network pollution sites, and construct a set V of network pollution nodes, where any node v i ∈V has a domain name IP address Web page content The three attributes are:

[0054] Furthermore, a network public nuisance site association graph is established based on hyperlink relationships. For example, if the homepage of www.se**a.com contains hyperlinks pointing to www.se**b.com, then a directed edge from www.se**a.com to www.se**b.com is added to the graph.

[0055] Step 3: Based on the data from the online nuisance research report, design and refine the technical approach for describing online nuisance behaviors;

[0056] Step four involves mapping the content of online nuisance websites to corresponding technical nodes based on language models such as TopicGPT. For example, mapping a nuisance website with the domain name www.se**a.com to a specific implementation method, and adding a technical value attribute to the node attributes of the online nuisance website. That is, for any v i ∈V,

[0057] By analyzing the set V of network pollution nodes, a network pollution association graph G = (V, E) is constructed, where V is the set of network pollution site nodes and E is an ordered pair (v...). i ,v j The set of () represents the pollution sites v in V. i To the pollution site v j The jump relationship;

[0058] Step 5: First, construct a subgraph based on the similarity of public nuisance site attributes. For the network public nuisance association graph G, if it can be determined by basic rules that adjacent graph nodes belong to the same public nuisance virtual community, then retain the corresponding node and edge; otherwise, delete the edge from the graph. The basic rules include: (1) Based on the domain name attributes of the association graph nodes. The discovery of node relationships. Adjacent nodes in the graph have similar domain names. For example, if the domain name of the first node is www.sehuiy**a.com and the domain name of the last node is www.sehuiy**b.com, then the two nodes are considered to belong to the same organization (where ** represents the same character value).

[0059] (2) Based on the IP address attribute of the node in the association graph The node relationship is discovered. Adjacent graph nodes have the same C segment in their IP address. For example, if the first node's IP address is ***.163.4.5 and the last node's IP address ends in ***.163.4.32, then the two nodes are considered to belong to the same organization (where *** represents the same A segment value); (3) Based on the webpage screenshot attributes of the associated graph nodes. The node relationships were discovered. The webpage screenshots of adjacent graph nodes showed similarities; for example, two websites might have the same website template but differ only in the website creation date. After filtering according to basic rules, a preliminary association graph of public nuisance assets within the virtual community network, G1 = (V1, E1), was obtained. and

[0060] Step Six: Based on the above subgraph, preliminary information about the virtual community of network pollution can be obtained. Following the order of the technical nodes in the technical route, the association graph can be represented as a directed acyclic graph. During this process, associations that do not satisfy the tactical order of network pollution are removed, such as those with edges (v...) in the graph. i ,v j ),but and If the tactical order relationship in the network public nuisance tactics matrix is ​​not satisfied, then the updated graph G1′=(V1′,E1′), where E1′=E1\{(v i ,v j Then, the technical routes of all paths on the graph are extracted to construct a set M of technical implementation modes for the virtual community of network pollution, where any implementation mode To implement a technical approach for a network public nuisance, and to use this technical approach as the behavioral pattern of the network public nuisance's virtual community;

[0061] Step 7: In the network pollution association graph G, select any m... k For edges e∈E that are ∈M but not in set E1′, add them to E1′ and repeat steps five through seven to discover hidden assets and hidden behavioral patterns in the same public nuisance virtual community;

[0062] Step 8: When no new nodes are added, output the network public nuisance association graph G1 of the same virtual community, which is the virtual community of the public nuisance virtual community.

[0063] like Figure 3 As shown, this application provides a network public nuisance virtual community discovery system based on association graph completion, the system comprising:

[0064] Network nuisance website attribute parsing module: This module acquires network nuisance websites, extracts the asset attributes of each website, including domain name, IP address, and webpage content, and treats each website as a network nuisance website node to construct a network nuisance website set. Each network nuisance website node is an element in the set. A network nuisance website refers to a network nuisance website that simultaneously contains corresponding domain names, IP addresses, and webpage content.

[0065] The Network Pollution Technical and Tactical Analysis Module collects certified network pollution research reports, analyzes the technical routes of network pollution and the implementation methods of the technical nodes in each technical route; among them, technical nodes are connected to form technical routes, and each technical node corresponds to one or more implementation methods;

[0066] The network pollution association graph construction module uses a large language model to map the webpage content of each network pollution site node to its corresponding implementation method. The implementation method corresponding to each network pollution site node is added as a new attribute of that network pollution site node. Each network pollution site node can correspond to one or more implementation methods. The network pollution association graph G = (V, E) is constructed, where V is the set of network pollution sites, and E is an ordered pair (v...). i ,v j The set of () represents the network public nuisance site nodes v in V. i To network public nuisance site node v j The redirection relationship is determined based on the IP address of the network public site node and the webpage content attributes;

[0067] The network public nuisance gang association graph completion module: Based on the attributes of the network public nuisance site nodes, the similarity between the network public nuisance site nodes is determined, the network public nuisance site set is divided into several subsets, and an association subgraph is built for each subset. The edges in the network public nuisance association graph are used as the edges in the association subgraph. The network public nuisance site nodes corresponding to the association subgraph form a network public nuisance virtual community.

[0068] For each associated subgraph: based on the order of each technical node in the technical route and the implementation means corresponding to each network pollution site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior pattern of the network pollution virtual community corresponding to the associated subgraph is determined.

[0069] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein, and such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for discovering virtual communities of network pollution based on association graph completion, characterized in that, The method includes the following steps: Step S1: The network nuisance site attribute parsing module obtains network nuisance sites, extracts the asset attributes of each network nuisance site, the asset attributes include domain name, IP address, and web page content, treats each network nuisance site as a network nuisance site node, constructs a network nuisance site set, and each network nuisance site node is an element in the network nuisance site set; the network nuisance site refers to a network nuisance website that includes corresponding domain names, IP addresses, and web page content at the same time; Step S2: The network pollution technology and tactics analysis module collects certified network pollution research reports, analyzes the technical routes of network pollution and the implementation methods of the technical nodes in each technical route; wherein, the technical nodes are connected to form a technical route, and each technical node corresponds to one or more implementation methods; Step S3: The network pollution association graph construction module uses a large language model to map the webpage content of each network pollution site node to its corresponding implementation method, and adds the implementation method corresponding to the network pollution site node as a new attribute of the network pollution site node. Each network pollution site node can correspond to one or more implementation methods; construct the network pollution association graph. ,in It is a collection of harmful online websites. In order to orderly The set, representing Network public nuisance site nodes To network public nuisance site nodes The redirection relationship is determined based on the IP address of the network public site node and the webpage content attributes; Step S4: The network public nuisance gang association graph completion module determines the similarity between network public nuisance site nodes based on the attributes of the network public nuisance site nodes, divides the network public nuisance site set into several subsets, establishes an association subgraph for each subset, and constructs the association subgraph based on the edges in the network public nuisance association graph. The network public nuisance site nodes corresponding to the association subgraph form a network public nuisance virtual community. For each associated subgraph: based on the order of each technical node in the technical route and the implementation means corresponding to each network public nuisance site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior pattern of the network public nuisance virtual community corresponding to the associated subgraph is determined; Step S4: Based on the order of each technical node in the technical route and the implementation means corresponding to each network public nuisance site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior mode of the network public nuisance virtual community corresponding to the associated subgraph is determined, including: determining the technical node corresponding to the implementation means of each network public nuisance site node in the associated subgraph. Delete directed edges in the associated subgraph that contradict the order of the technical nodes in the technical route; Convert the associated subgraph into a directed acyclic graph; Based on the implementation methods corresponding to each network pollution site node in the directed acyclic graph, the behavior pattern corresponding to the associated subgraph is determined, and this behavior pattern is taken as the behavior pattern of the network pollution virtual community corresponding to the associated subgraph.

2. The method as described in claim 1, characterized in that, The method for discovering virtual communities that spread content-related online nuisances further includes: Step S5: identifying online nuisance site nodes whose behavioral patterns are more than a preset threshold similar to the behavioral patterns of the online nuisance virtual community as associated online nuisance site nodes of the online nuisance virtual community; and performing behavioral pattern mining on the online nuisance virtual community and associated online nuisance site nodes to determine the hidden behavioral patterns of the online nuisance virtual community.

3. The method according to any one of claims 1-2, characterized in that, In step S4, the network nuisance gang association graph completion module determines the similarity between network nuisance site nodes based on the attributes of the network nuisance site nodes, divides the network nuisance site set into several subsets, establishes an association subgraph for each subset, and constructs the association subgraph based on the edges in the network nuisance association graph, including: grouping network nuisance site nodes with domain name similarity greater than a first preset threshold into the same subset; grouping network nuisance site nodes with IP address similarity greater than a second preset threshold into the same subset; and grouping network nuisance site nodes with webpage content similarity greater than a third preset threshold into the same subset. For each subset: obtain all network pollution site node pairs in the subset. If there is a directed edge between the network pollution site node pairs in the network pollution association graph, then establish a directed edge between the network pollution site node pairs in the subset; thus forming an association subgraph.

4. The method as described in claim 2, characterized in that, Step S5: Network pollution site nodes whose behavior patterns are more than a preset threshold similar to the behavior patterns of the network pollution virtual community are identified as associated network pollution site nodes of the network pollution virtual community. The behavior pattern mining of the virtual community of network public nuisance and its associated network public nuisance site nodes is performed to determine the hidden behavior pattern of the virtual community of network public nuisance, including: merging the associated network public nuisance site nodes into the subset corresponding to the virtual community of network public nuisance, establishing an association subgraph for the updated subset, and converting the association subgraph corresponding to the updated subset into a directed acyclic graph. Based on the directed acyclic graph, the behavioral pattern corresponding to the associated subgraph is determined, and this behavioral pattern is used as the hidden behavioral pattern of the virtual community of network pollution.

5. A network pollution virtual community discovery system based on association graph completion, characterized in that, The system includes: Network nuisance website attribute parsing module: This module acquires network nuisance websites, extracts the asset attributes of each website, including domain name, IP address, and webpage content, and treats each website as a network nuisance website node to construct a network nuisance website set. Each network nuisance website node is an element in the set. A network nuisance website refers to a network nuisance website that simultaneously contains corresponding domain names, IP addresses, and webpage content. The Network Pollution Technical and Tactical Analysis Module collects certified network pollution research reports, analyzes the technical routes of network pollution and the implementation methods of the technical nodes in each technical route; among them, technical nodes are connected to form technical routes, and each technical node corresponds to one or more implementation methods; Network Pollution Relationship Graph Construction Module: This module uses a large language model to map the webpage content of each network pollution site node to its corresponding implementation method. The implementation method corresponding to each network pollution site node is added as a new attribute of that node. Each network pollution site node can correspond to one or more implementation methods. This constructs the network pollution relationship graph. ,in It is a collection of harmful online websites. In order to orderly The set, representing Network public nuisance site nodes To network public nuisance site nodes The redirection relationship is determined based on the IP address of the network public site node and the webpage content attributes; The network public nuisance gang association graph completion module: Based on the attributes of the network public nuisance site nodes, the similarity between the network public nuisance site nodes is determined, the network public nuisance site set is divided into several subsets, and an association subgraph is built for each subset. The edges in the network public nuisance association graph are used as the edges in the association subgraph. The network public nuisance site nodes corresponding to the association subgraph form a network public nuisance virtual community. For each associated subgraph: based on the order of each technical node in the technical route and the implementation means corresponding to each network public nuisance site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior pattern of the network public nuisance virtual community corresponding to the associated subgraph is determined; Based on the order of each technical node in the technical route and the implementation means corresponding to each network public nuisance site node in the associated subgraph, the associated subgraph is converted into a directed acyclic graph; based on the directed acyclic graph, the behavior mode of the network public nuisance virtual community corresponding to the associated subgraph is determined, including: determining the technical node corresponding to the implementation means of each network public nuisance site node in the associated subgraph. Delete directed edges in the associated subgraph that contradict the order of the technical nodes in the technical route; Convert the associated subgraph into a directed acyclic graph; Based on the implementation methods corresponding to each network pollution site node in the directed acyclic graph, the behavior pattern corresponding to the associated subgraph is determined, and this behavior pattern is taken as the behavior pattern of the network pollution virtual community corresponding to the associated subgraph.

6. A computer-readable storage medium storing a plurality of instructions; the plurality of instructions being loaded by a processor and executing the method as claimed in any one of claims 1-4.

7. An electronic device, characterized in that, The electronic device includes: A processor is used to execute multiple instructions; Memory, used to store multiple instructions; The plurality of instructions are to be stored in the memory and loaded by the processor and executed as described in any one of claims 1-4.

Images