A method for detecting telecom fraud websites based on dynamic double optimization incremental learning

Abstract

A kind of telecommunication fraud website detection method based on dynamic double optimization incremental learning, comprising the following steps: step 1, constructing telecommunication fraud website dataset;Step 2, based on bidirectional encoder representation model, construct the multi-source heterogeneous feature extraction model for extracting telecommunication fraud website features;Step 3, for the current incremental task, based on dynamic double optimization incremental learning method, make the multi-source heterogeneous feature extraction model carry out incremental learning;Using the trained multi-source heterogeneous feature extraction model extracts new telecommunication fraud website features, detects new telecommunication fraud website.The present application can accurately identify different types of fraud websites, and can realize the continuous detection of new fraud websites by the method of incremental learning.

Description

Technical Field

[0001] This invention relates to the fields of network security technology, website detection, and incremental detection, and in particular to a method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning. Background Technology

[0002] With the rapid development and widespread adoption of internet technology, the internet has become a core infrastructure for modern life and work. According to statistics from the International Telecommunication Union (ITU) in 2022, there were 5.4 billion active internet users worldwide. People use the internet to obtain information, learn, entertain themselves, conduct business, and exchange scientific and academic knowledge. As a platform for gathering netizens and disseminating information, websites are inevitably exploited by criminals, becoming hotspots for telecommunications fraud. Many criminals use the internet to build fraudulent websites and set up scams to defraud victims remotely without physical contact. Typical criminal patterns include: online shopping scams involving rebates, fake online investment and financial management scams, online dating scams, impersonating law enforcement officials, and fabricating shopping and loan scenarios to steal payment passwords, verification codes, or directly induce fund transfers. Telecommunications fraud websites seriously threaten citizens' personal information security, property rights, and social order, and have become a common challenge to global governance.

[0003] The shortcomings of existing telecom fraud website detection technologies lie in their inability to accurately identify different types of fraudulent websites and their lack of continuous detection capabilities for new types of fraudulent websites. This is because: 1. Fraudulent website domains are complex and diverse, and the types of fraud are numerous, making it difficult for traditional detection methods to effectively analyze their behavioral patterns; 2. Fraudsters often design new types of fraudulent websites to bypass the identification of existing detection models, causing traditional detection methods to fail. Summary of the Invention

[0004] In view of the above-mentioned deficiencies of the prior art, the present invention provides a method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning, which can accurately identify different types of fraud websites and can achieve continuous detection of new types of fraud websites through incremental learning.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A method for detecting telecom fraud websites based on dynamic dual-optimization incremental learning includes the following steps:

[0007] Step 1: Construct a dataset of telecom fraud websites;

[0008] Step 2: Construct a multi-source heterogeneous feature extraction model based on the bidirectional encoder representation model for extracting features of telecom fraud websites;

[0009] Step 3, based on the dynamic double optimization incremental learning method, the multi-source heterogeneous feature extraction model is used for incremental learning for the current incremental task; the multi-source heterogeneous feature extraction model is used to extract new telecom fraud website features and detect new telecom fraud websites.

[0010] As preferred, the step 2 comprises:

[0011] Step 2.1, obtaining and preprocessing the URL, webpage content and WHOIS information of the telecom fraud website;

[0012] Step 2.2, generating URL features, webpage content features and WHOIS features respectively;

[0013] Step 2.3, fusing the URL features, webpage content features and WHOIS features to generate the fraud website features.

[0014] As preferred, in the step 2.2, for the URL of the telecom fraud website, a bidirectional encoder representation model loaded with English general base pre-training weights is used to extract the URL features; for the webpage content in the telecom fraud website, a bidirectional encoder representation model loaded with Chinese base pre-training weights is used to extract the webpage content features; based on whether the domain registration time exceeds six months and whether the place of origin is located in a weak judicial supervision area, a 2-dimensional feature is constructed as the WHOIS feature.

[0015] As preferred, the step 3 comprises:

[0016] Step 3.1, dynamically decoupling the multi-source heterogeneous feature extraction model into a general feature layer mainly learning general features and a classification feature layer mainly learning classification features;

[0017] Step 3.2, using gradient-based distillation loss to optimize the general feature layer;

[0018] Step 3.3, using classification cross-entropy loss to optimize the classification feature layer;

[0019] Step 3.4, based on the experience replay strategy, saving the representative samples of the current incremental task for playback in the next incremental learning;

[0020] Step 3.5, saving the trained multi-source heterogeneous feature extraction model.

[0021] As preferred, in the step 3.1, the multi-source heterogeneous feature extraction model comprises 12 layers of Transformer encoders; for the current incremental task, layer mean vectors of intermediate results in each layer of the Transformer encoders of the current multi-source heterogeneous feature extraction model are calculated; based on the layer mean vectors, cosine similarities between the layer mean vectors of the first 11 layers and the layer mean vector of the last layer are respectively calculated to obtain decoupling measurement values of the layers; if the decoupling measurement value of a layer is greater than or equal to a preset threshold, the layer and the Transformer encoders before the layer are divided into the general feature layers; if the decoupling measurement value of a layer is less than the preset threshold, the layer and the Transformer encoders after the layer are divided into the classification feature layers.

[0022] As preferred, the preset threshold is 0.5.

[0023] As preferred, the step 3.2 comprises:

[0024] The samples of the current incremental task are simultaneously input into the current multi-source heterogeneous feature extraction model and the multi-source heterogeneous feature extraction models trained for the previous t-1 old tasks

[0025] The intermediate results of the general feature layers of the current multi-source heterogeneous feature extraction model and the intermediate results of the corresponding position frozen layers of the multi-source heterogeneous feature extraction models trained for the previous t-1 old tasks are subjected to KL divergence calculation to obtain the distillation loss L1 The gradient information calculated by the KL divergence is used as a weight coefficient to dynamically adjust the distillation loss L1, and the difference between the mean value of the decoupling measurement values of the layers in the general feature layers and 1 is used as a coefficient a of the distillation loss L1.

[0026] As preferred, the step 3.3 comprises:

[0027] For the classification feature layers of the current multi-source heterogeneous feature extraction model , the outputs of all the multi-source heterogeneous feature extraction models are subjected to feature fusion by feature splicing, and the classification cross-entropy loss L2 is calculated by a classifier and real classification labels, and the reciprocal of the mean value of the decoupling measurement values of the layers in the classification feature layers is used as a coefficient b of the classification cross-entropy loss L2.

[0028] As preferred, the step 3.4 comprises:

[0029] ​A replay sample set with a fixed capacity M is constructed; in the current incremental task After the training is completed, the current incremental task The mean vector of all samples; the Euclidean distance between the mean vector and all samples of the current incremental task M / t replay samples of the first t-1 old tasks in the replay sample set are randomly reserved, and the remaining samples are deleted; from the sample set of the current incremental task M / t samples with the smallest Euclidean distance from the mean vector are selected and added to the replay sample set.

[0030] Compared with the prior art, the beneficial effects of the present application are embodied in:

[0031] 1. Precise detection of telecom fraud websites. The multi-source heterogeneous feature extraction model includes word segmentation, embedding, bidirectional encoder representation model and classifier. First, the URL and webpage content of the fraud website are converted into a continuous vector form that can be processed by the bidirectional encoder representation model through word segmentation and embedding. Then, using the powerful text semantic processing capability of the bidirectional encoder representation model, the semantic relationship of the URL and webpage content of the fraud website is constructed, and the WHOIS information is integrated as auxiliary features, obtaining the multi-source heterogeneous feature fusion of the telecom fraud website. Finally, the classifier is trained using this feature, and the loss of the predicted label and the real label of the classifier is used to optimize the entire multi-source feature fusion network. Since the features of the telecom fraud website are fused from multiple key features, it can well restore its original appearance. Even in the case of numerous categories of telecom fraud websites, it can still be accurately classified.

[0032] 2. Continuous detection of new telecom fraud websites. The incremental learning method based on dynamic double optimization decouples the multi-source heterogeneous feature extraction model into two parts. First, by calculating the cosine similarity between the intermediate results of each layer of the bidirectional encoder representation model in the multi-source heterogeneous feature extraction model and the output features of the last layer, the bidirectional encoder representation model is decoupled into two parts according to the similarity. Then, independent loss constraints are applied to the front part (focusing on learning general features of different types of fraud websites) and the back part (focusing on learning classification features of different types of fraud websites), realizing dynamic double optimization of the bidirectional encoder representation model. At the same time, the distillation loss with the previous model is introduced to constrain the previously learned knowledge from being covered, which can effectively alleviate the catastrophic forgetting problem in the incremental learning process. Through the above dynamic double optimization incremental learning method, the detection model can effectively avoid catastrophic forgetting while continuously detecting new telecom fraud websites. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1A framework diagram of the multi-source heterogeneous feature extraction model of embodiment 1 of the present application;

[0034] Figure 2 A framework diagram of the dynamic double optimization incremental learning method of embodiment 1 of the present application;

[0035] Figure 3 A confusion matrix heat map of the classification result of embodiment 1 of the present application;

[0036] Figure 4 A T-SNE visualization diagram of the classification result of embodiment 1 of the present application. DETAILED DESCRIPTION

[0037] In order to make the technical means, creative features, purposes and effects of the invention easy to understand, the present application will be further described in conjunction with specific drawings. However, the present application is not limited to the following embodiments.

[0038] It should be noted that the structure, proportion, size, etc. shown in the drawings attached to the present specification are only used to cooperate with the content disclosed in the specification for understanding and reading by those skilled in the art, and do not define the limiting conditions for the implementation of the present application, so they do not have technical substantive significance. Any modification of structure, change of proportion relationship or adjustment of size, without affecting the effects and purposes that can be achieved by the present application, should still fall within the scope of the technical content disclosed by the present application.

[0039] In view of the current 12,000 new fraudulent websites per day (National Internet Emergency Center 2023 data), the lack of precision recognition ability of traditional telecom website fraud detection models, and the lack of continuous detection technical pain points, the present patent develops a telecom fraud website detection model based on dynamic double optimization incremental learning. With the help of the bidirectional semantic encoding ability of the bidirectional encoder representation model (BERT model), the multi-source heterogeneous features of the URL, webpage content and WHOIS information (domain name registration information) of the telecom fraud website are extracted. At the same time, the online updating mechanism of incremental learning technology is used to train a telecom fraud website detection model with both precision recognition and continuous detection capabilities, providing real-time technical support for protecting citizens' personal information security and property rights.

[0040] Embodiment 1:

[0041] As shown in Figure 1 A telecom fraud website detection method based on dynamic double optimization incremental learning, comprising the following steps:

[0042] Step 1, constructing a telecom fraud website dataset;

[0043] The telecom fraud website dataset used in the experiment is independently constructed by the application, which collects 11104 URLs of 7 types of websites, and is divided into training set and test set in the ratio of 4:1. The 7 types of websites include normal, investment fraud, marriage fraud, online loan fraud, phishing fraud, shopping fraud and impersonation of public security law fraud. The detailed statistical information and the division of incremental learning tasks are shown in Table 1:

[0044] Table 1: Detailed statistical information of the telecom fraud website dataset and division of incremental learning tasks

[0045]

[0046] Step 2, a multi-source heterogeneous feature extraction model for identifying telecom fraud websites is constructed based on a bidirectional encoder representation model;

[0047] With the increasing diversification and complexity of telecom fraud websites, it is particularly important to accurately identify different types of fraud websites. Existing malicious website detection methods mostly focus on binary classification problems, i.e., detecting whether a website is normal or malicious, which is difficult to accurately identify different types of fraud websites. In order to solve the above problems, the present application proposes a multi-source heterogeneous feature extraction model. The model can effectively identify different types of fraud websites by fusing multi-source fusion features of fraud websites. As shown in the construction of the multi-source heterogeneous feature extraction model, the specific process includes the following steps: Figure 1

[0048] Step 2.1, obtaining and preprocessing the URL, web content and WHOIS information of the telecom fraud website;

[0049] Telecom fraud websites, like normal websites, have URL, web content and WHOIS information (necessary information provided by domain name registrants to the registration authority when registering domain names). However, through analysis, it is found that the URL of the fraud website either confuses the user's vision and hearing compared with the normal legal URL, or looks very strange, such as "www.badu.com", "http: / / www.7h3sx91n.com" and the like. The web content is focused on high-risk scenarios such as financial transfer, cross-border dating, and adult services. In addition, the telecom fraud website in the WHOIS server is usually in a region with weak legal jurisdiction, and the registration time is relatively short, generally less than 6 months. Therefore, for the detection of telecom fraud websites, the present application mainly analyzes from three aspects: URL, web content and WHOIS information.

[0050] ​For the telecom fraud website dataset, the application first initiates a hypertext transfer protocol GET request to the web server pointed to by the URL in the request library through the get method, and obtains the content of the entire HTTP web page. Then, the pure text content of the HTTP web page is extracted using the get_text method of the web parsing tool library. The extracted web page content is data cleaned to obtain the web page content. In order to obtain the complete WHOIS information of the website, the application sends a query request to the WHOIS server to obtain the registration time and home information of the domain name.

[0051] Since the bidirectional encoder representation model cannot directly process the text data of the original URL and web content, the application first converts the URL and web content into numerical representations that can be recognized by the model through tokenization. Specifically, tokenization splits the input text into token sequences at the word or subword level. Then, each unit in these sequences is mapped to a unique token ID, so that the URL and web content are converted into discrete numerical forms, facilitating the processing of the bidirectional encoder representation model. In order to enable the bidirectional encoder representation model to better understand and process text data, the application needs to embed key information such as semantic information, sentence structure and position information in each token ID and convert it into a continuous vector. To this end, the application performs a series of embedding operations on each token ID, including word embedding, segment embedding and position embedding. These embedding operations aim to preserve and enhance key information in the text, thereby improving the model's ability to process text data.

[0052] Step 2.2, generating URL features, web content features and WHOIS features using a bidirectional encoder representation model;

[0053] The bidirectional encoder representation model used in this patent consists of 12 layers of Transformer encoders. Such a deep structure enables the bidirectional encoder representation model to effectively capture dependencies between different positions in the input sequence and accurately capture rich semantic information. Each Transformer encoder contains a multi-head attention mechanism, a feedforward neural network, a residual connection and a layer normalization module.

[0054] The multi-head attention mechanism is the core component of the Transformer, consisting of 12 independent self-attention modules that work in parallel to form 12 attention heads. These attention heads capture and learn semantic information and contextual relationships from multiple dimensions and fuse these information together to form the output of the multi-head attention mechanism.

[0055] The feedforward neural network performs a nonlinear transformation on the vector output by the multi-head attention mechanism, thereby enhancing the expressiveness of the bidirectional encoder representation model. The structure thereof comprises a fully connected layer, a ReLU activation function, and another fully connected layer. Specifically, the first fully connected layer maps each Token processed by the multi-head attention mechanism from 768 dimensions to 3072 dimensions. The second fully connected layer compresses these 3072-dimensional features back to 768 dimensions, achieving deep processing and refinement of the features.

[0056] The residual connection and layer normalization module can effectively address the gradient vanishing problem that may occur during the training process of the multi-head attention mechanism and the feedforward neural network, and improve the convergence speed and stability of the model, thereby enhancing the robustness and reliability of the entire model.

[0057] The fine capture of semantic information and contextual information by the multi-head attention mechanism, the deep feature extraction by the feedforward neural network, and the stable training process of the residual connection and layer normalization module together constitute the output of the Transformer encoder. When the 12-layer Transformer encoder is stacked together, the output of the topmost encoder is the final feature representation of the bidirectional encoder representation model.

[0058] For the URL of a fraudulent website, a bidirectional encoder representation model loaded with English general base pre-training weights is used to extract URL features (768 dimensions); for the text content in the webpage of a fraudulent website, a bidirectional encoder representation model loaded with Chinese base pre-training weights is used to extract webpage content features (768 dimensions). Based on whether the domain name registration time exceeds six months and whether the location of the registration is in a region with weak judicial supervision, the present application can construct a 2-dimensional feature as a WHOIS feature.

[0059] Step 2.3, fuse the URL features, webpage content features, and WHOIS features to generate fraudulent website features.

[0060] After bidirectional encoder representation feature representation, the present application successfully extracts URL features and webpage text features containing rich semantics, deep information, and contextual relationships. In order to further improve the accuracy and efficiency of subsequent classification tasks, the present application fuses URL features, webpage text features, and WHOIS features to achieve effective fusion of multi-source heterogeneous features. This feature fusion method can comprehensively utilize information from different sources and types, improve the comprehensive judgment ability of the model for fraudulent websites, and thus accurately identify different types of telecommunications fraud websites.

[0061] Step 3, for the current incremental task, based on the dynamic dual optimization incremental learning method, the multi-source heterogeneous feature extraction model performs incremental learning; the trained multi-source heterogeneous feature extraction model is used to test new types of telecommunications fraud websites.

[0062] In practical applications, telecom fraud websites are constantly evolving new types to evade detection and expand the scope of attacks, which brings great challenges to their continuous detection. If the old and new data are mixed and the detection model is retrained, a large amount of computation and time overhead will be generated, which is difficult to meet the rapid response requirements of practical applications. Therefore, incremental learning emerges as the times require, which can only use new data or a small amount of old data to achieve continuous learning of new data, but inevitably leads to the problem of catastrophic forgetting of the model during the process, which makes it difficult to be directly applied to practical scenarios. Therefore, the present patent combines the dynamic dual optimization incremental learning method to realize the continuous detection of new type fraud websites and alleviate the problem of catastrophic forgetting. As shown in Figure 2 , it is assumed that the training of the first t-1 incremental tasks in the fraud website dataset has been completed , the training of the tth incremental task specifically includes the following processes:

[0063] Step 3.1, dynamically decoupling the multi-source heterogeneous feature extraction model into a general feature layer mainly learning general features and a classification feature layer mainly learning classification features;

[0064] The multi-source heterogeneous feature extraction model proposed in the present patent is based on a bidirectional encoder representation model, which includes 12 layers of Transformer encoders. These Transformer encoders extract general features and classification features for specific classification tasks from the front to the back of the URL and webpage text of the telecom fraud website. Traditional model training strategies often ignore this feature, but instead impose loss constraints on the final output of the model to optimize the model parameters. However, strict loss constraints on the output results can easily lead to overfitting of the front part of the model (Transformer encoders responsible for learning general features), thereby reducing the generalization ability of the model and causing forgetting of old tasks.

[0065] To achieve this dynamic decoupling strategy, the current incremental task , the specific steps are as follows: first, calculate the layer mean vector of the intermediate results in each layer of the current multi-source heterogeneous feature extraction model ; then, based on the mean vector, the cosine similarity of the first 11 layers and the last layer is calculated respectively, and the decoupling measure value of each layer is obtained. Take 0.5 as the threshold: if the decoupling measure value of a layer is ≥0.5, then the Transformer encoders of that layer and before it are divided into a general feature layer, mainly learning general features; if the decoupling measure value is <0.5, then the Transformer encoders of that layer and after it are divided into a classification feature layer, mainly learning classification features.

[0066] Step 3.2, using gradient-based distillation loss L1 to optimize the general feature layer;

[0067] In the incremental training process, the present application not only inputs a batch of data into the current multi-source heterogeneous feature extraction model but also inputs it into the multi-source heterogeneous feature extraction model trained by the previous t-1 tasks (parameter freezing). For the general feature layer of the current multi-source heterogeneous feature extraction model , the present application calculates the gradient-based distillation loss between the intermediate result output by the general feature layer and the intermediate result of the corresponding position frozen layer of the old task model to obtain the loss L1, and uses the difference between the average of the decoupling measurement values of each layer in the general feature layer and 1 as the coefficient a (0.5 < a < 1) to constrain L1, L1 is only used to optimize the general feature layer. When calculating the distillation loss, the present application uses the gradient-based weight as the adjustment coefficient. Specifically, in a batch of training data, for each training sample, when it is input into , if the sample belongs to the replay sample of the old task , , it is input into to obtain the intermediate result at the corresponding frozen layer as the distillation vector; if the sample belongs to the new task , it is input into all old task models , and the average vector of the intermediate results at the corresponding frozen layers of all old task models is taken as the distillation vector. Then, the distillation vector of the old task model is transmitted to the general feature layer of the current multi-source heterogeneous feature extraction model through the general feature connection, and the KL divergence is calculated; and the KL divergence gradient information is used as the weight coefficient, so as to realize the dynamic adjustment of the distillation loss.

[0068] Step 3.3, using classification cross-entropy loss L2 to optimize the classification feature layer;

[0069] For the classification feature layer of the current multi-source heterogeneous feature extraction model , the present application fuses the outputs of all multi-source heterogeneous feature extraction models through splicing, and calculates the cross-entropy loss through the classifier and the real classification label as the loss constraint L2 of the classification feature layer, and uses the reciprocal of the decoupling measurement value of each layer in the classification feature layer as the coefficient b (1 < b < 2) of L2, L2 is only used to optimize the classification feature layer. Through this double optimization before and after, the present application can better balance the learning of new and old tasks in the incremental learning process, avoid overfitting of the general feature, and alleviate the catastrophic forgetting problem of the old task in the incremental training process.

[0070] Step 3.4, based on the experience replay strategy, save the representative samples of the current incremental task for the next incremental learning to be replayed;

[0071] To alleviate the catastrophic forgetting problem of old tasks in traditional incremental learning and train a stable and reliable incremental model, the experience replay strategy is adopted in the patent. The strategy maintains a replay sample set with a fixed capacity of M. After each new data is added, the replay data in the set is updated. The specific update strategy is as follows:

[0072] In the incremental task After the training is completed, the present application calculates the mean vector of all samples. Then, the Euclidean distance between the mean vector and the incremental task all samples is calculated. Then, from the replay sample set, M / t replay samples are randomly retained for the first t-1 old tasks, and the remaining samples are deleted. Finally, from the sample set of , the M / t samples with the smallest Euclidean distance to the mean vector are selected and added to the replay sample set. Through the above update strategy, the most representative samples in the distribution space of each task can be selected. Replaying these samples during the incremental training phase and combining with the loss constraint can effectively alleviate the catastrophic forgetting problem of old tasks.

[0073] Step 3.5, save the trained multi-source heterogeneous feature extraction model.

[0074] After the training is completed, in order to preserve all the information of the model, the model parameters are saved in the form of a dictionary on the disk. The saved model parameters include weights, biases and other parameters, as well as some important information during the training process, such as the number of iterations, loss function values, etc. The saved model parameters can be loaded when needed for prediction or further analysis.

[0075] To verify the precise identification ability of the proposed dynamic double optimization incremental learning-based telecom fraud website detection model (hereinafter referred to as "the proposed model") for different types of telecom fraud websites, the present application uses the test set to verify its performance. The experimental evaluation indicators include average accuracy (mACC) and backward transfer (BWT): where mACC is used to measure the average performance of the model in all previous learning tasks, and the higher the value, the better the detection performance; BWT is used to evaluate the impact of learning new tasks on the performance of previous learning tasks, and the smaller the value, the stronger the model's ability to alleviate catastrophic forgetting. The experimental results show that the performance of the proposed model on mACC and BWT reaches 84.0% and 10.98%, respectively. At the same time, the confusion matrix heat map of the test set detection results (such as Figure 3As shown in the figure, the proposed model performs well in classifying all types of telecom fraud websites, validating its ability to effectively learn new tasks without forgetting old ones. Furthermore, the T-SNE visualization of the feature vectors on the test set (as shown in the figure) demonstrates that the proposed model achieves good classification results across all types of telecom fraud websites, validating its ability to effectively learn new tasks without forgetting old ones. Figure 4 As shown in the figure, the proposed model can effectively distinguish between different types of telecom fraud websites. In summary, the proposed model can accurately identify different types of telecom fraud websites and has the ability to continuously learn new types of telecom fraud websites.

Claims

1. A method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning, characterized in that, Includes the following steps: Step 1: Construct a dataset of telecom fraud websites; Step 2: Construct a multi-source heterogeneous feature extraction model based on the bidirectional encoder representation model for extracting features of telecom fraud websites; Step 3: For the current incremental task, the multi-source heterogeneous feature extraction model is made to perform incremental learning based on the dynamic dual optimization incremental learning method. The trained multi-source heterogeneous feature extraction model is used to extract features of novel telecom fraud websites and detect novel telecom fraud websites, including: Step 3.1: Dynamically decouple the multi-source heterogeneous feature extraction model into a general feature layer that learns general features and a classification feature layer that learns classification features; Step 3.2: Optimize the general feature layer using gradient-based distillation loss; Step 3.3: Optimize the classification feature layer using classification cross-entropy loss; Step 3.4: Based on the experience replay strategy, save the representative samples of the current incremental task for replay in the next incremental learning; Step 3.5: Save the trained multi-source heterogeneous feature extraction model; In step 3.1, the multi-source heterogeneous feature extraction model includes 12 Transformer encoder layers. For the current incremental task, the layer mean vector of the intermediate results in each Transformer encoder layer of the current multi-source heterogeneous feature extraction model is calculated. Based on each layer mean vector, the cosine similarity between the layer mean vectors of the first 11 layers and the layer mean vector of the last layer is calculated to obtain the decoupling measure value of each layer. If the decoupling measure value of a certain layer is greater than or equal to a preset threshold, then the Transformer encoder layer before that layer is classified as the general feature layer. If the decoupling measure value of a certain layer is less than the preset threshold, then the Transformer encoder layer after that layer is classified as the classification feature layer.

2. The method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning according to claim 1, characterized in that, The preset threshold is 0.

5.

3. The method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning according to claim 1, characterized in that, Step 3.2 includes: The current incremental task The samples are simultaneously input into the current multi-source heterogeneous feature extraction model. The multi-source heterogeneous feature extraction model trained on the previous t-1 old tasks middle; The current multi-source heterogeneous feature extraction model The intermediate results of the general feature layer and the multi-source heterogeneous feature extraction model trained on the previous t-1 old tasks KL divergence calculations were performed on the intermediate results of the frozen layer at the corresponding location to obtain the distillation loss L1. The gradient information calculated using KL divergence is used as a weighting coefficient to dynamically adjust the distillation loss L1. At the same time, the difference between the mean of the decoupling measure of each layer in the general feature layer and 1 is used as the coefficient a of the distillation loss L1.

4. The method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning according to claim 3, characterized in that, Step 3.3 includes: For the current multi-source heterogeneous feature extraction model The aforementioned classification feature layer extracts all multi-source heterogeneous features. The output is fused by feature concatenation, and the classification cross-entropy loss L2 is calculated by the classifier and the true classification label. At the same time, the reciprocal of the mean of the decoupling measure of each layer in the classification feature layer is used as the coefficient b of the classification cross-entropy loss L2.

5. The method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning according to claim 4, characterized in that, Step 3.4 includes: Construct a replay sample set with a fixed capacity of M; in the current incremental task After training, calculate the current incremental task. The mean vector of all samples; calculate the mean vector and the current incremental task. The Euclidean distance of all samples; randomly retain M / t replay samples from the first t-1 old tasks in the replay sample set, and delete the remaining samples; from the current incremental task From the sample set, select the M / t samples with the smallest Euclidean distance from the mean vector and add them to the playback sample set.

6. The method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning according to claim 1, characterized in that, Step 2 includes: Step 2.1: Obtain and preprocess the URLs, webpage content, and WHOIS information of telecom fraud websites; Step 2.2: Generate URL features, webpage content features, and WHOIS features respectively; Step 2.3: Combine the URL features, the webpage content features, and the WHOIS features to generate the fraudulent website features.

7. The method for detecting telecommunications fraud websites based on dynamic dual-optimization incremental learning according to claim 6, characterized in that, In step 2.2, for the URL of the telecom fraud website, a bidirectional encoder representation model with pre-trained weights in English is used to extract the URL features; for the webpage content in the telecom fraud website, a bidirectional encoder representation model with pre-trained weights in Chinese is used to extract the webpage content features. Based on whether the domain name registration time exceeds six months and whether the place of origin is located in an area with weak judicial supervision, a 2-dimensional feature is constructed as the WHOIS feature.

Images