Information detection method, electronic equipment and storage medium

Abstract

The invention provides an information detection method, electronic equipment and a storage medium, and the method comprises the steps: carrying out the regularization processing of target sampling information, so as to obtain a regularization result; if the regular result represents that the target sampling information comprises the key field, inputting the target sampling information into an information detection model to obtain a primary detection result; inputting the target sampling information and the primary detection result into an information detection model to obtain a secondary detection result; inputting the target sampling information, the primary detection result, the secondary detection result and the regular result into an information detection model to obtain a third detection result; and inputting the target sampling information, the primary detection result, the secondary detection result, the third detection result and the result output instruction into an information detection model to obtain an information detection result corresponding to the target sampling information, and repeatedly inputting the target sampling information and the detection result into the information detection model for detection and analysis. And the obtained information detection result is more accurate.

Description

Technical Field

[0001] The present invention relates to the field of information detection, and in particular to an information detection method, electronic equipment and storage medium. Background Art

[0002] In a network system, an information interface is usually used to receive traffic information of its corresponding service. However, since the privacy level of traffic information corresponding to different services is different (for example, the privacy level of traffic information of a service corresponding to one information interface is higher than that of traffic information of a service corresponding to another information interface), it is necessary to identify the privacy of traffic information involving private data and perform desensitization processing. The current method for identifying private data is obtained by performing semantic recognition on traffic information. Since semantic recognition performs semantic analysis on all traffic information, and the semantic analysis is implemented according to preset semantic judgment logic, when the content of the traffic information is too large or too complex, the computing power occupied by this method for identifying and detecting private data of traffic information is too large, and the detection accuracy is also low. Summary of the Invention

[0003] In view of the above technical problems, the technical solution adopted by the present invention is:

[0004] According to one aspect of the present application, there is provided an information detection method, which is applied to a target information interface;

[0005] The information detection method comprises the following steps:

[0006] Step S100: In response to receiving target sampling information, regularize the target sampling information to obtain a regularized result;

[0007] Step S200: If the regularization result indicates that the target sampling information includes the key field, the target sampling information is input into a preset information detection model to obtain a detection result output by the information detection model; the information detection model is obtained by training a plurality of historical sample information;

[0008] Step S300: input the target sampling information and the primary detection result into the information detection model to obtain the secondary detection result output by the information detection model;

[0009] Step S400: input the target sampling information, the primary detection result, the secondary detection result and the regularization result into the information detection model to obtain the tertiary detection result output by the information detection model;

[0010] Step S500: Input the target sampling information, the first detection result, the second detection result, the third detection result and the preset result output instruction into the information detection model to obtain the information detection result corresponding to the target sampling information output by the information detection model; the output structure of the information detection result meets the structural requirements corresponding to the result output instruction.

[0011] In an exemplary embodiment of the present application, a generalized regular expression is used to regularize the target sampling information.

[0012] In an exemplary embodiment of the present application, the information detection model is determined by the following steps:

[0013] Step S201: Obtain some historical sample information to obtain a historical sample information list V = (V1, V2, ..., V a ,...,V b ); where a=1,2,...,b; b is the number of historical sample information; V a is the ath historical sample information; the historical sample information is the traffic information received during the historical collection period; the end time of the historical collection period is before the current time;

[0014] Step S202: Obtain the key fields included in each historical sample information to obtain a key field list set W = (W1, W2, ..., W a ,...,W b ); where W a The key field list corresponding to the a-th historical sample information;

[0015] W a =(W a1 ,W a2 ,...,W ac ,...,W ad(a) ); where c = 1, 2, ..., d(a); d(a) is the number of key fields included in the a-th historical sample information; W ac is the cth key field included in the ath historical sample information;

[0016] Step S203: Obtain the detection result identifier corresponding to each historical sample information to obtain a detection result identifier list Z = (Z1, Z2, ..., Z a ,...,Z b ); where Z a is the detection result identifier corresponding to the a-th historical sample information;

[0017] When V a When the corresponding information detection result is characterized as including key fields, Z a Determined to be 1; when Va When the corresponding information detection result is characterized as not including key fields, Z a Determine to 0;

[0018] Step S204: V a 、W a , Z a Input into the preset general language model to obtain the information detection model.

[0019] In an exemplary embodiment of the present application, the target sampling information is determined by the following steps:

[0020] Step S001: Obtain the traffic information critical level A corresponding to the target information interface;

[0021] Step S002: obtaining the amount B of historical traffic information received by the target information interface within a historical time period; the length of the historical time period is a preset time length; and the end time of the historical time period is before the current time;

[0022] Step S003: Determine the sampling score C corresponding to the target information interface = (A p / (B+q) 1 / 2 )×(1 / D); p is the preset information level coefficient; q is the preset flow smoothing factor; D is the preset normalization factor;

[0023] Step S004: When the target information interface receives the flow information, randomly generate an information value corresponding to the flow information;

[0024] Step S005: If the information value corresponding to the flow information is less than C, the flow information is determined as the target sampling information received by the target information interface.

[0025] In an exemplary embodiment of the present application, after step S500, the information detection method further includes:

[0026] Step S600: Determine a target critical level corresponding to the target information interface based on information detection results corresponding to a plurality of target sample information determined by the target information interface within a target time period; the length of the target time period is equal to the length of the historical time period; the end time of the target time period is the current time; and the start time of the target time period is after the end time of the historical time period;

[0027] Step S700: Determine the target criticality level corresponding to the target information interface as the traffic information criticality level corresponding to the target information interface.

[0028] In an exemplary embodiment of the present application, step S600 includes:

[0029] Step S610: Obtain information detection results of a plurality of target sampled information determined within a target time period by a plurality of information interfaces in the service cluster where the target information interface is located, and determine a key field score corresponding to the target information interface;

[0030] Step S620: Determine the impact range score corresponding to the target information interface based on the node depth and data level of the target information interface in the preset link map;

[0031] Step S630: Determine the product of the key field score corresponding to the target information interface and the impact range score as the target key score R corresponding to the target information interface;

[0032] Step S640: If R≥T2, the target criticality level corresponding to the target information interface is determined to be the first level;

[0033] If T1≤R<T2, the target criticality level corresponding to the target information interface is determined to be the second level;

[0034] If R<T1, the target criticality level corresponding to the target information interface is determined to be the third level;

[0035] Among them, T1 and T2 are preset critical score thresholds; 0<T1<T2<1; the criticality corresponding to the first level, second level, and third level decreases in sequence.

[0036] In an exemplary embodiment of the present application, step S610 includes:

[0037] Step S611: Acquire key fields included in a number of target sampling information determined by the target information interface within the target time period to obtain a target key field list set E=(E1, E2, ..., E g ,...,E h ); where g = 1, 2, ..., h; h is the number of target sampling information determined by the target information interface within the target time period; E g The key field list corresponding to the g-th target sampling information determined by the target information interface within the target time period;

[0038] E g =(E g1 ,E g2 ,...,E gm ,...,E gn(g) ); m = 1, 2, ..., n (g); n (g) is the number of key fields included in the g-th target sampling information determined by the target information interface within the target time period; E gm The mth key field included in the gth target sampling information determined by the target information interface within the target time period;

[0039] Step S612: Get E gm The corresponding preset key weight F gm ;

[0040] Step S613: Determine the key information score corresponding to each target sampling information of the target information interface within the target time period to obtain a key information score list G=(G1, G2, ..., G g ,...,G h ); where G g =∑ m＝1 n(g) (F gm );G g The key information score corresponding to the g-th target sampling information determined by the target information interface within the target time period;

[0041] Step S614: Obtain preset key weights corresponding to key fields included in a number of sampled information determined within a target time period for the remaining information interfaces in the service cluster where the target information interface is located;

[0042] Step S615: Determine the sum of the preset key weights corresponding to all key fields included in each sample information as the key information score corresponding to the sample information;

[0043] Step S616, determine the key field score H=I / I0 corresponding to the target information interface; where I=MAX(G); I0 is the maximum key information score corresponding to all information interfaces in the service cluster where the target information interface is located; MAX() is a preset maximum value determination function.

[0044] In an exemplary embodiment of the present application, step S620 includes:

[0045] Step S621: Obtain the number L of services directly called by the target information interface in the preset link map;

[0046] Step S622: Obtain the data transfer depth M corresponding to the target information interface;

[0047] When the target information interface is used directly, the data flow depth corresponding to the target information interface is determined to be r1; when the target information interface is used for indirect secondary processing, the data flow depth corresponding to the target information interface is determined to be r2; 0<r1<r2;

[0048] Step S623: Determine the hierarchical impact score N=L×M corresponding to the target information interface;

[0049] Step S624: Determine the hierarchical impact score corresponding to the target information interface by multiplying the number of services directly called by the remaining information interfaces in the service cluster where the target information interface is located in the preset link map by the data flow depth corresponding to the information interface;

[0050] Step S625: Determine the impact range score Q=N / N0 corresponding to the target information interface; wherein N0 is the maximum hierarchical impact score corresponding to all information interfaces in the service cluster where the target information interface is located.

[0051] According to one aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored. The at least one instruction or the at least one program is loaded and executed by a processor to implement the aforementioned information detection method.

[0052] According to one aspect of the present application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0053] The present invention has at least the following beneficial effects:

[0054] The information detection method of the present invention performs regularization processing on the target sampling information to obtain the regularized result corresponding to the target sampling information. If the regularized result indicates that the target sampling information includes a key field, the target sampling information is input into the information detection model to obtain the first detection result corresponding to the target sampling information output by the information detection model. The target sampling information and the first detection result are then input into the information detection model to obtain the second detection result corresponding to the target sampling information output by the information detection model. The target sampling information, the first detection result, the second detection result and the regularized result are then input into the information detection model to obtain the third detection result corresponding to the target sampling information output by the information detection model. Sampling information, primary detection results, secondary detection results, tertiary detection results and result output instructions are input into the information detection model to obtain the information detection results corresponding to the target sampling information output by the information detection model. By first regularizing the target sampling information and then performing detection processing on the model, the target sampling information entering the information detection model can be sampling information including key fields, so as to reduce the number of detection processing times of the information detection model and reduce the processing computing power of the information detection model. Moreover, by repeatedly inputting the target sampling information and the detection results of the information detection model into the information detection model for detection and analysis, the information detection results of the target sampling information obtained can be made more accurate, thereby improving the detection accuracy of the key fields of the target sampling information. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0056] Figure 1 This is a flow chart of an information detection method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0058] The present application proposes an information detection method, which is applied to a target information interface. The target information interface corresponds to a target service, and the target information interface is used to receive traffic information corresponding to the target service.

[0059] like Figure 1 As shown, the information detection method includes the following steps:

[0060] Step S100: In response to receiving target sampling information, regularize the target sampling information to obtain a regularized result;

[0061] Among them, a generalized regular expression is used to regularize the target sampling information. Using a generalized (i.e., rough) regular expression to regularize the target sampling information can improve the accuracy of the information detection results while reducing the amount of target sampling information processed by the subsequent information detection model, thereby reducing the computing power occupied by the information detection model.

[0062] Step S200: If the regularization result indicates that the target sampling information includes a key field, the target sampling information is input into a preset information detection model to obtain a primary detection result output by the information detection model;

[0063] The information detection model is obtained by training a number of historical sample information. Specifically, the information detection model is determined through steps S201 to S204:

[0064] Step S201: Obtain some historical sample information to obtain a historical sample information list V = (V1, V2, ..., V a ,...,V b); where a=1,2,...,b; b is the number of historical sample information; V a is the ath historical sample information;

[0065] The historical sample information is the traffic information received during the historical collection period; the end time of the historical collection period is before the current time.

[0066] Step S202: Obtain the key fields included in each historical sample information to obtain a key field list set W = (W1, W2, ..., W a ,...,W b ); where W a The key field list corresponding to the a-th historical sample information;

[0067] W a =(W a1 ,W a2 ,...,W ac ,...,W ad(a) ); where c = 1, 2, ..., d(a); d(a) is the number of key fields included in the a-th historical sample information; W ac is the cth key field included in the ath historical sample information;

[0068] Step S203: Obtain the detection result identifier corresponding to each historical sample information to obtain a detection result identifier list Z = (Z1, Z2, ..., Z a ,...,Z b ); where Z a is the detection result identifier corresponding to the a-th historical sample information;

[0069] When V a When the corresponding information detection result is characterized as including key fields, Z a Determined to be 1; when V a When the corresponding information detection result is characterized as not including key fields, Z a Determine to 0;

[0070] Several historical sample information and the information detection results corresponding to each historical sample information are stored in a preset historical sample list, and whenever a target sampling information is determined to have an information detection result, the target sampling information is determined as historical sample information, and the target sampling information and the information detection results corresponding to the target sampling information are both stored in the historical sample list to enrich the training samples of the information detection model and improve the detection accuracy of the information detection model.

[0071] Step S204: V a 、W a , Z aInput into the preset general language model to obtain the information detection model.

[0072] The general language model can use the template of the existing large language model.

[0073] Step S300: input the target sampling information and the primary detection result into the information detection model to obtain the secondary detection result output by the information detection model;

[0074] Step S400: input the target sampling information, the primary detection result, the secondary detection result and the regularization result into the information detection model to obtain the tertiary detection result output by the information detection model;

[0075] Step S500: input the target sampling information, the primary detection result, the secondary detection result, the tertiary detection result, and the preset result output instruction into the information detection model to obtain the information detection result corresponding to the target sampling information output by the information detection model;

[0076] The information detection result is characterized by whether the target sampling information includes key fields. The key fields may be privacy fields (such as name, mobile phone number, ID number, travel ticket number, etc., which are information fields involving user personal privacy). Therefore, the information detection result is used to indicate whether the target sampling information includes privacy fields, and the output structure of the information detection result meets the structural requirements corresponding to the result output instruction.

[0077] The target sampling information is tested multiple times through the information detection model, and in subsequent tests, the target sampling information is combined with the previous test results and input into the information detection model as the information to be tested, so that the final information detection result of the target sampling information is more accurate.

[0078] Furthermore, the target sampling information is determined through steps S001 to S005:

[0079] Step S001: Obtain the traffic information critical level A corresponding to the target information interface;

[0080] The traffic information criticality level may be a privacy level of the received traffic information corresponding to the target information interface. This privacy level may be set by the user according to the services corresponding to different information interfaces.

[0081] Step S002: Obtain the amount B of historical traffic information received by the target information interface within a historical time period;

[0082] The length of the historical time period is a preset time length; the end time of the historical time period is before the current time; and the historical traffic information is the traffic information received by the target information interface during the historical time period.

[0083] Step S003: Determine the sampling score C corresponding to the target information interface = (A p / (B+q) 1 / 2 )×(1 / D);

[0084] Among them, p is the preset information level coefficient; q is the preset traffic smoothing factor; D is the preset normalization factor; the sampling score corresponding to the target information interface is the numerical threshold for receiving traffic information set by the target information interface; as a preferred embodiment, p and q can be set to 1.

[0085] Step S004: When the target information interface receives the flow information, randomly generate an information value corresponding to the flow information;

[0086] After the target information interface determines the sampling score corresponding to the target information interface, the target information interface will randomly generate an information value corresponding to the traffic information each time it receives a flow information. The method for randomly generating the information value can adopt the existing value generation method (such as setting a random number generator, and each time a flow information is received, the random number generator will randomly generate an information value corresponding to the flow information). It should be noted that the information value is only used to compare with the sampling score of the target information interface to determine the target sampling information, and does not limit the content of the flow information.

[0087] Step S005: If the information value corresponding to the flow information is less than C, the flow information is determined as the target sampling information received by the target information interface.

[0088] After generating the information value corresponding to the traffic information, if the information value corresponding to the traffic information is less than the sampling score of the target information interface, the traffic information is determined as the target sampling information, that is, the traffic information is selected as the target sampling information for verifying the privacy field; conversely, if the information value corresponding to the traffic information is not less than the sampling score of the target information interface, the traffic information is discarded and not used to verify the privacy field.

[0089] On the other hand, after step S500, the information detection method further includes steps S600 to S700:

[0090] Step S600: Determine a target criticality level corresponding to the target information interface based on information detection results corresponding to a plurality of target sampling information determined by the target information interface within a target time period;

[0091] The length of the target time period is equal to the length of the historical time period, the end time of the target time period is the current time, and the start time of the target time period is after the end time of the historical time period.

[0092] The target criticality level corresponding to the target information interface is the privacy level of the target information interface within the target time period determined based on the information detection result of the target sampling information received by the target information interface.

[0093] Furthermore, step S600 includes steps S610 to S640:

[0094] Step S610: Obtain information detection results of a plurality of target sampled information determined within a target time period by a plurality of information interfaces in the service cluster where the target information interface is located, and determine a key field score corresponding to the target information interface;

[0095] Wherein, step S610 includes steps S611 to S616:

[0096] Step S611: Acquire key fields included in a number of target sampling information determined by the target information interface within the target time period to obtain a target key field list set E=(E1, E2, ..., E g ,...,E h ); where g = 1, 2, ..., h; h is the number of target sampling information determined by the target information interface within the target time period; E g The key field list corresponding to the g-th target sampling information determined by the target information interface within the target time period;

[0097] E g =(E g1 ,E g2 ,...,E gm ,...,E gn(g) ); m = 1, 2, ..., n (g); n (g) is the number of key fields included in the g-th target sampling information determined by the target information interface within the target time period; E gm The mth key field included in the gth target sampling information determined by the target information interface within the target time period;

[0098] Step S612: Get E gm The corresponding preset key weight F gm ;

[0099] Each key field has a corresponding key weight (i.e., privacy field weight). For example, when the key field is an ID number, its corresponding key weight is 3; when the key field is health data, its corresponding key weight is 2; when the key field is a mobile phone number, its corresponding key weight is 1.

[0100] Step S613: Determine the key information score corresponding to each target sampling information of the target information interface within the target time period to obtain a key information score list G=(G1, G2, ..., Gg ,...,G h );

[0101] Among them, G g =∑ m＝1 n(g) (F gm );G g The key information score corresponding to the g-th target sampling information determined by the target information interface within the target time period.

[0102] Step S614: Obtain preset key weights corresponding to key fields included in a number of sampled information determined within a target time period for the remaining information interfaces in the service cluster where the target information interface is located;

[0103] The method for detecting key fields in the sampled information of the remaining information interfaces in the service cluster where the target information interface is located within the target time period is the same as the method for detecting key fields corresponding to the target information interface, and will not be repeated here.

[0104] Step S615: Determine the sum of the preset key weights corresponding to all key fields included in each sample information as the key information score corresponding to the sample information;

[0105] Step S616: Determine the key field score H=I / I0 corresponding to the target information interface;

[0106] Wherein, I=MAX(G); I0 is the maximum key information score corresponding to all information interfaces in the service cluster where the target information interface is located; MAX() is a preset maximum value determination function.

[0107] Step S620: Determine the impact range score corresponding to the target information interface based on the node depth and data level of the target information interface in the preset link map;

[0108] Wherein, step S620 includes steps S621 to S625:

[0109] Step S621: Obtain the number L of services directly called by the target information interface in the preset link map;

[0110] Step S622: Obtain the data transfer depth M corresponding to the target information interface;

[0111] When the target information interface is used directly, the data flow depth corresponding to the target information interface is determined to be r1; when the target information interface is used for indirect secondary processing, the data flow depth corresponding to the target information interface is determined to be r2; 0<r1<r2; as a feasible embodiment, r1 can be 1 and r2 can be 2.

[0112] Step S623: Determine the hierarchical impact score N=L×M corresponding to the target information interface;

[0113] Step S624: Determine the hierarchical impact score corresponding to the target information interface by multiplying the number of services directly called by the remaining information interfaces in the service cluster where the target information interface is located in the preset link map by the data flow depth corresponding to the information interface;

[0114] The link graph stores the service call relationships of several information interfaces.

[0115] Step S625: Determine the impact range score Q=N / N0 corresponding to the target information interface;

[0116] N0 is the maximum hierarchical impact score corresponding to all information interfaces in the service cluster where the target information interface is located.

[0117] Step S630: Determine the product of the key field score corresponding to the target information interface and the impact range score as the target key score R corresponding to the target information interface;

[0118] Step S640: If R≥T2, the target criticality level corresponding to the target information interface is determined to be the first level;

[0119] If T1≤R<T2, the target criticality level corresponding to the target information interface is determined to be the second level;

[0120] If R<T1, the target criticality level corresponding to the target information interface is determined to be the third level;

[0121] Among them, T1 and T2 are preset critical score thresholds; 0<T1<T2<1; the criticality corresponding to the first level, second level, and third level decreases in turn, that is, the first level has the highest privacy level and the third level has the lowest privacy level.

[0122] Step S700: Determine the target criticality level corresponding to the target information interface as the traffic information criticality level corresponding to the target information interface.

[0123] After determining the target critical level of the target information interface, the target critical level of the target information interface is determined as the new traffic information critical level of the target information interface, so that the target information interface samples the traffic information at the new traffic information critical level, and then the latest target critical level is re-determined by regularizing the sampled target sampling information and the detection results of the information detection model to adjust the critical level of the target information interface, so as to achieve a balanced optimization between the sampling quantity of traffic information received by the target information interface and the critical level of the target information interface.

[0124] The information detection method of the present invention performs regularization processing on the target sampling information to obtain the regularized result corresponding to the target sampling information. If the regularized result indicates that the target sampling information includes a key field, the target sampling information is input into the information detection model to obtain the first detection result corresponding to the target sampling information output by the information detection model. The target sampling information and the first detection result are then input into the information detection model to obtain the second detection result corresponding to the target sampling information output by the information detection model. The target sampling information, the first detection result, the second detection result and the regularized result are then input into the information detection model to obtain the third detection result corresponding to the target sampling information output by the information detection model. Sampling information, primary detection results, secondary detection results, tertiary detection results and result output instructions are input into the information detection model to obtain the information detection results corresponding to the target sampling information output by the information detection model. By first regularizing the target sampling information and then performing detection processing on the model, the target sampling information entering the information detection model can be sampling information including key fields, so as to reduce the number of detection processing times of the information detection model and reduce the processing computing power of the information detection model. Moreover, by repeatedly inputting the target sampling information and the detection results of the information detection model into the information detection model for detection and analysis, the information detection results of the target sampling information obtained can be made more accurate, thereby improving the detection accuracy of the key fields of the target sampling information.

[0125] An embodiment of the present invention further provides a computer program product comprising program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present invention described above in this specification.

[0126] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0127] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0128] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0129] Those skilled in the art will appreciate that various aspects of the present invention may be implemented as systems, methods, or program products. Therefore, various aspects of the present invention may be implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits," "modules," or "systems."

[0130] The electronic device according to this embodiment of the present invention is merely an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0131] The electronic device is implemented as a general-purpose computing device. Components of the electronic device may include, but are not limited to, the aforementioned at least one processor, the aforementioned at least one storage, and a bus connecting different system components (including the storage and the processor).

[0132] The storage stores program codes, which can be executed by the processor, so that the processor performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification.

[0133] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0134] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0135] The bus may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0136] The electronic device may also communicate with one or more external devices (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication may be performed via an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter.

[0137] In exemplary embodiments of the present disclosure, a computer-readable storage medium is also provided, on which is stored a program product capable of implementing the aforementioned methods of this specification. In some possible implementations, various aspects of the present invention may also be implemented in the form of a program product comprising program code. When the program product is executed on a terminal device, the program code is configured to cause the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the "Exemplary Methods" section of this specification.

[0138] The program product may be implemented in any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0139] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0140] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0141] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0142] Furthermore, the figures above are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention and are not intended to be limiting. It is readily understood that the processes illustrated in the figures above do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0143] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0144] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. An information detection method, characterized in that: Applied to target information interface; The method comprises the following steps: Step S100: In response to receiving target sampling information, regularize the target sampling information to obtain a regularized result; Step S200: If the regularization result indicates that the target sampling information includes a key field, the target sampling information is input into a preset information detection model to obtain a primary detection result output by the information detection model; The information detection model is obtained by training a number of historical sample information; Step S300: input the target sampling information and the primary detection result into the information detection model to obtain a secondary detection result output by the information detection model; Step S400: input the target sampling information, the primary detection result, the secondary detection result, and the regularization result into the information detection model to obtain the tertiary detection results output by the information detection model; Step S500: input the target sampling information, the primary detection result, the secondary detection result, the tertiary detection result, and a preset result output instruction into the information detection model to obtain an information detection result corresponding to the target sampling information output by the information detection model; The output structure of the information detection result meets the structural requirements corresponding to the result output instruction.

2. The method according to claim 1, characterized in that The target sampling information is regularized using a generalized regular expression.

3. The method according to claim 2, characterized in that The information detection model is determined by the following steps: Step S201: Obtain some historical sample information to obtain a historical sample information list V = (V1, V2, ..., V a ,...,V b ); where a=1, 2, ..., b; b is the number of historical sample information; V a is the ath historical sample information; the historical sample information is the traffic information received during the historical collection period; the end time of the historical collection period is before the current time; Step S202: Obtain the key fields included in each of the historical sample information to obtain a key field list set W = (W1, W2, ..., W a ,...,W b ); where W a The key field list corresponding to the a-th historical sample information; W a =(W a1 ,W a2 ,...,W ac ,...,W ad(a) ); where c = 1, 2, ..., d(a); d(a) is the number of key fields included in the a-th historical sample information; W ac is the cth key field included in the ath historical sample information; Step S203: Obtain the detection result identifier corresponding to each of the historical sample information to obtain a detection result identifier list Z = (Z1, Z2, ..., Z a ,...,Z b ); where Z a is the detection result identifier corresponding to the a-th historical sample information; When V a When the corresponding information detection result is characterized as including key fields, Z a Determined to be 1; when V a When the corresponding information detection result is characterized as not including key fields, Z a Determine to 0; Step S204: V a 、W a , Z a Input into the preset general language model to obtain the information detection model.

4. The method according to claim 3, characterized in that The target sampling information is determined by the following steps: Step S001: Obtain the traffic information critical level A corresponding to the target information interface; Step S002: obtaining the amount B of historical traffic information received by the target information interface within a historical time period; the length of the historical time period is a preset time length; and the end time of the historical time period is before the current time; Step S003: Determine the sampling score C corresponding to the target information interface = (A p / (B+q) 1 / 2 )×(1 / D); p is the preset information level coefficient; q is the preset flow smoothing factor; D is the preset normalization factor; Step S004: when the target information interface receives flow information, randomly generate an information value corresponding to the flow information; Step S005: If the information value corresponding to the flow information is less than C, the flow information is determined as the target sampling information received by the target information interface.

5. The method according to claim 4, characterized in that After step S500, the method further includes: Step S600: Determine a target critical level corresponding to the target information interface based on information detection results corresponding to a plurality of target sampling information determined by the target information interface within a target time period; the length of the target time period is equal to the length of the historical time period; the end time of the target time period is the current time; and the start time of the target time period is after the end time of the historical time period; Step S700: Determine the target criticality level corresponding to the target information interface as the traffic information criticality level corresponding to the target information interface.

6. The method according to claim 5, characterized in that The step S600 includes: Step S610: Obtain information detection results of a plurality of target sampling information determined by a plurality of information interfaces in the service cluster where the target information interface is located within the target time period, and determine a key field score corresponding to the target information interface; Step S620: Determine the influence range score corresponding to the target information interface based on the node depth and data level of the target information interface in the preset link map; Step S630: Determine the product of the key field score corresponding to the target information interface and the impact range score as the target key score R corresponding to the target information interface; Step S640: If R≥T2, the target criticality level corresponding to the target information interface is determined to be the first level; If T1≤R<T2, the target criticality level corresponding to the target information interface is determined to be the second level; If R<T1, the target criticality level corresponding to the target information interface is determined to be the third level; Among them, T1 and T2 are preset critical score thresholds; 0<T1<T2<1; the critical degrees corresponding to the first level, the second level, and the third level decrease in sequence.

7. The method according to claim 6, characterized in that The step S610 includes: Step S611: Acquire key fields included in a number of target sampling information determined by the target information interface within the target time period to obtain a target key field list set E=(E1, E2, ..., E g ,...,E h ); wherein g = 1, 2, ..., h; h is the number of target sampling information determined by the target information interface within the target time period; E g A list of key fields corresponding to the g-th target sampling information determined by the target information interface within the target time period; E g =(E g1 ,E g2 ,...,E gm ,...,E gn(g) ); m = 1, 2, ..., n (g); n (g) is the number of key fields included in the g-th target sampling information determined by the target information interface within the target time period; E gm The mth key field included in the gth target sampling information determined by the target information interface within the target time period; Step S612: Get E gm The corresponding preset key weight F gm ; Step S613: Determine the key information score corresponding to each target sampling information of the target information interface within the target time period to obtain a key information score list G=(G1, G2, ..., G g ,...,G h ); where G g =∑ m＝1 n(g) (F gm );G g The key information score corresponding to the g-th target sampling information determined by the target information interface within the target time period; Step S614: Obtain preset key weights corresponding to key fields included in a number of sampled information determined within the target time period for the remaining information interfaces in the service cluster where the target information interface is located; Step S615: Determine the sum of preset key weights corresponding to all key fields included in each sample information as the key information score corresponding to the sample information; Step S616, determine the key field score H=I / I0 corresponding to the target information interface; where I=MAX(G); I0 is the maximum key information score corresponding to all information interfaces in the service cluster where the target information interface is located; MAX() is a preset maximum value determination function.

8. The method according to claim 7, characterized in that The step S620 includes: Step S621: Obtain the number L of services directly called by the target information interface in the preset link map; Step S622: Obtain the data transfer depth M corresponding to the target information interface; When the target information interface is used directly, the data flow depth corresponding to the target information interface is determined to be r1; when the target information interface is used for indirect secondary processing, the data flow depth corresponding to the target information interface is determined to be r2; 0<r1<r2; Step S623: Determine the hierarchical impact score N=L×M corresponding to the target information interface; Step S624: Determine the hierarchical impact score corresponding to the target information interface by multiplying the number of services directly called by the remaining information interfaces in the service cluster where the target information interface is located in the preset link map by the data flow depth corresponding to the information interface; Step S625: Determine the impact range score Q=N / N0 corresponding to the target information interface; wherein N0 is the maximum hierarchical impact score corresponding to all information interfaces in the service cluster where the target information interface is located.

9. A non-transitory computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1 to 8.

10. An electronic device, characterized in that: The device comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 9.

Images