A method and system for website information review and control

Abstract

This application relates to a website information review and control method and system. The method includes: acquiring user interaction data from a live streaming website in real time, and dividing the interaction data into multiple time windows according to a preset time length; evaluating the content consistency of the interaction data within each time window, and identifying consistent interaction content; calculating the frequency of occurrence of the consistent interaction content within the time window to obtain the burst density of the consistent interaction content; extracting and evaluating the user account feature information that sent the consistent interaction content to obtain the source features of the consistent interaction content; and determining whether there is any illegal collaborative action based on the burst density, the source features, and the real-time interaction content of the live streaming website. If illegal collaborative action is found, a preset handling plan is executed against the illegal collaborative action. This invention can quickly process illegal information transmitted covertly through real-time multi-party interaction by malicious users, significantly improving the accuracy and timeliness of website information review.

Description

Technical Field

[0001] This application relates to the field of website information review and control technology, and in particular to a website information review and control method and system. Background Technology

[0002] In the current online environment, one of the core businesses of large content publishing platforms is to strictly review and control user-generated content to ensure its compliance and security. However, existing website information review and control methods struggle to effectively identify and handle highly contextualized and subtly conveyed violations in real-time interactive live content, posing a serious challenge to the accuracy and timeliness of the review process.

[0003] To combat the covert methods employed by malicious users, such as homophones, wordplay, metaphors, allusions, or embedding difficult-to-identify symbols and gestures in images to convey inappropriate information, website information review has attempted to expand its rules and introduce more complex contextual analysis strategies, such as N-gram analysis and convolutional neural networks (CNNs). However, these strategies have led to an explosive increase in the number of rules, a sharp rise in maintenance costs, and potential conflicts between rules, resulting in a higher false positive rate. This causes many legitimate contents to be misjudged, while truly concealed violations remain difficult to detect, impacting the efficiency and accuracy of the review process.

[0004] Meanwhile, with the introduction of real-time interactive live streaming, website information review also faces new challenges. Due to the highly real-time, interactive, and instantaneous nature of live streaming content, the information carrier is no longer merely pre-edited text, images, or video clips, but rather a dynamic interaction between the streamer and the audience, and among viewers themselves, at a specific point in time and under specific circumstances. Streamers may convey inappropriate information through verbal cues, eye contact, or interaction with viewers via live chat. This information itself may not contain explicitly prohibited words or images, but its inappropriate intent and effect only become apparent when combined with the atmosphere of the live stream and the immediate feedback from viewers.

[0005] In the aforementioned scenarios, traditional review and control methods based on static content features are almost incapable of making accurate judgments when faced with real-time live content that requires contextual understanding. This leads to hidden violations in live streams becoming a new blind spot in the review process. Therefore, we propose a website information review and control method and system. Summary of the Invention

[0006] This application provides a website information review and control method and system to at least solve the problem that existing website information review and control methods in the related art have difficulty in effectively identifying and processing illegal information conveyed through multi-party real-time interaction, which is highly contextualized and implicitly transmitted when handling real-time interactive live content, resulting in serious challenges to the accuracy and timeliness of the review.

[0007] Firstly, this application provides a website information review and control method, the method comprising:

[0008] Real-time acquisition of user interaction information data from live streaming websites, and division of the interaction information data into multiple time windows according to a preset time length;

[0009] The consistency of the interactive information data within each time window is evaluated, and consistent interactive content is identified.

[0010] Calculate the frequency of occurrence of the consistent interaction content within the time window to obtain the burst density of the consistent interaction content;

[0011] Extract and evaluate the user account feature information that sent the consistent interaction content to obtain the source features of the consistent interaction content;

[0012] Based on the outbreak density, the source characteristics, and the real-time interactive content of the live streaming website, it is determined whether there is any illegal coordinated action. If there is illegal coordinated action, a preset handling plan is implemented for the illegal coordinated action.

[0013] Optionally, determining whether there is any illegal coordinated action based on the outbreak density, the source characteristics, and the real-time interactive content of the live streaming website includes:

[0014] Real-time capture of the interactive behavior time points of each online user within the live streaming website, generating a time series of online user activities;

[0015] The activity time series of the online users are converted into behavioral rhythm vectors within a preset rhythm analysis window;

[0016] Calculate the similarity between the behavioral rhythm vectors of online users within the rhythm analysis window, and based on the similarity, identify online user groups with synchronized behavioral rhythms to obtain synchronized action groups;

[0017] Retrieve the interactive content sent by all online users in the synchronized action group within the rhythm analysis window, and perform semantic analysis on the interactive content to identify the collective intent of the synchronized action group;

[0018] Based on the size of the synchronized action group, the collective intent, and the historical behavioral characteristics of the online user group, it is determined whether there is any illegal coordinated action.

[0019] Optionally, the real-time capture of each online user's interactive behavior time points within the live streaming website to generate a user activity time series includes:

[0020] Retrieve the local timestamp of each online user's interaction behavior within the live streaming website and the global timestamp of the global time synchronization server;

[0021] The local timestamp is calibrated based on the global timestamp to obtain the calibration timestamp and the residual error of calibrating the local timestamp, and the calibration strategy for subsequent timestamps is adjusted based on the residual error.

[0022] Acquire historical calibration data and network latency data for each online user, calculate and apply personalized time calibration factors for each online user, and calibrate the timestamps of interactive behaviors from different online users.

[0023] The calibration timestamps are correlated with the interactive behaviors of online users to generate a time series of user activities.

[0024] Optionally, converting the online user's activity time series into a behavioral rhythm vector within a preset rhythm analysis window includes:

[0025] The rhythm analysis window is divided into multiple time slices;

[0026] The number of interactive behaviors contained in each time slice is counted, and the interactive behaviors are classified and counted according to their types to obtain the number of different types of interactive behaviors;

[0027] Based on the number of different types of interactive behaviors within the time slice, calculate the comprehensive intensity value of the interactive behaviors within the time slice;

[0028] The behavior rhythm vector is constructed by using the comprehensive intensity value as the element value of the corresponding time slice in the behavior rhythm vector.

[0029] Optionally, calculating the similarity between the behavioral rhythm vectors of online users within the rhythm analysis window includes:

[0030] Extract the temporal features of each of the behavioral rhythm vectors to obtain a behavioral pattern feature set, wherein the temporal features include the start time, duration, peak intensity, behavioral type sequence, and behavioral interval distribution of the behavior;

[0031] Calculate the nonlinear similarity between the behavioral pattern feature sets, wherein the nonlinear similarity is obtained by distance calculation or sequence alignment algorithm with dynamic time warping, and when calculating the nonlinear similarity, behavioral type weights are introduced according to different types of interactive behaviors, and the behavioral type weights are used to reflect the importance of the different types of interactive behaviors in the expression of collective intent.

[0032] Monitor the volatility of the nonlinear similarity and adjust or optimize the parameters or weights for calculating the nonlinear similarity based on the volatility.

[0033] Optionally, monitoring the volatility of the nonlinear similarity includes:

[0034] The calculation results of the nonlinear similarity are obtained in real time;

[0035] Time series analysis of the calculation results is performed to extract the fluctuation frequency, fluctuation amplitude, and fluctuation duration of the calculation results;

[0036] Based on the fluctuation frequency, the fluctuation amplitude, and the fluctuation duration, identify whether there are periodic fluctuations or discontinuous changes in the calculation results;

[0037] If the periodic fluctuations or discontinuous changes exist, the historical fluctuation data of the live streaming website will be used to determine whether the fluctuations are spoofed.

[0038] Optionally, if the periodic fluctuations or discontinuous changes exist, determining whether the fluctuations are spoofed fluctuations, in conjunction with the historical fluctuation data of the live streaming website, includes:

[0039] The sequence of the calculation results is acquired in real time, and the changing trends between adjacent time points and the fluctuation patterns in different time periods are identified to obtain trend characteristics and local fluctuation patterns.

[0040] By correlating the trend characteristics with the local fluctuation patterns, multi-stage fluctuation patterns are obtained.

[0041] The multi-stage fluctuation pattern is imported into a preset avoidance strategy pattern library for comparison to determine whether the fluctuation is a disguised fluctuation.

[0042] Optionally, the step of importing the multi-stage fluctuation pattern into a preset avoidance strategy pattern library for comparison to determine whether the fluctuation is a disguised fluctuation includes:

[0043] Extract multi-dimensional features of the multi-stage fluctuation pattern, wherein the multi-dimensional features include the complexity of the behavior pattern, the entropy value of the behavior sequence, and the sparsity of the behavior pattern.

[0044] The multi-dimensional features are nonlinearly mapped and dimensionality-reduced with the features of the patterns in the avoidance strategy pattern library to obtain the projected fluctuation pattern.

[0045] The distribution density and cluster dispersion of the projected wave pattern in the low-dimensional feature space are analyzed to identify the difference points, wherein the difference points are isolated points that do not belong to the known pattern clusters or newly formed cluster centers.

[0046] The difference points are compared with a preset difference threshold to determine whether the fluctuation is a masquerade fluctuation.

[0047] Secondly, this application provides a website information review and control system, the control system comprising:

[0048] The acquisition module is used to acquire user interaction information data from the live streaming website in real time and divide the interaction information data into multiple time windows according to a preset time length;

[0049] An evaluation module is used to evaluate the consistency of the interactive information data within each time window and identify consistent interactive content.

[0050] The calculation module is used to calculate the frequency of occurrence of the consistent interaction content within the time window, and to obtain the burst density of the consistent interaction content.

[0051] The feature evaluation module is used to extract and evaluate the user account feature information that sent the consistent interaction content, and obtain the source feature of the consistent interaction content.

[0052] The determination module is used to determine whether there is any illegal coordinated action based on the outbreak density, the source characteristics, and the real-time interactive content of the live streaming website.

[0053] The handling module is used to execute a preset handling plan for any illegal collaborative actions.

[0054] Thirdly, this application provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the website information audit control method provided in the first aspect above.

[0055] Compared with related technologies, the website information review and control method and system provided in this application have at least the following technical effects:

[0056] By acquiring real-time user interaction data from live streaming websites and dividing it into time windows, the system assesses the consistency of interaction data within each time window, identifies consistent interaction content, and calculates its burst density. This effectively identifies highly consistent, concealed violations that erupt within a short period. Subsequently, by combining user account characteristics with burst density and real-time interaction content from the live streaming website, the system can effectively determine whether there is any coordinated violation. If such coordinated violation is found, a pre-set handling plan is executed. This allows for rapid processing of violations transmitted covertly through real-time multi-party interactions by malicious users. This effectively solves the technical challenge of identifying and handling concealed coordinated violations in real-time interactive live streaming content, significantly improving the accuracy and timeliness of website information review.

[0057] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0058] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0059] Figure 1 This is a flowchart illustrating a website information review and control method according to an exemplary embodiment.

[0060] Figure 2 This is a flowchart illustrating step S5 according to an exemplary embodiment.

[0061] Figure 3 This is a flowchart illustrating step S51 according to an exemplary embodiment.

[0062] Figure 4 This is a flowchart illustrating step S52 according to an exemplary embodiment.

[0063] Figure 5 This is a flowchart illustrating step S53 according to an exemplary embodiment.

[0064] Figure 6 This is a partial flowchart illustrating step S534 according to an exemplary embodiment. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0066] Obviously, the accompanying drawings described below are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar scenarios based on these drawings without any inventive effort. Furthermore, it is understood that although the efforts made in this development process may be complex and lengthy, for those skilled in the art related to the content disclosed in this application, any changes to design, manufacturing, or production based on the technical content disclosed in this application are merely conventional technical means and should not be construed as insufficient disclosure of the content of this application.

[0067] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0068] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," and "third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0069] In related technologies, even if traditional review systems can identify individual prop names or live chat behaviors, they cannot understand the implicit meanings they carry in specific contexts. This makes it almost impossible for review systems to make accurate judgments when faced with these highly contextualized, dynamically generated violations that rely on multi-party interactions.

[0070] Based on the above, embodiments of the present invention provide a website information review and control method and system, which will be described in detail below with reference to specific embodiments and accompanying drawings.

[0071] Example 1

[0072] This invention provides a method for website information review and control. Figure 1 This is a flowchart illustrating a website information review and control method according to an exemplary embodiment. For example... Figure 1 As shown, the method includes:

[0073] S1. Real-time acquisition of user interaction information data from the live streaming website, and division of the interaction information data into multiple time windows according to a preset time length. In this embodiment, the user interaction information data includes various interaction data generated by users on the live streaming website, such as bullet comments, comments, likes, rewards, and requests for live streaming; the time window is a segment of continuous interaction information data divided according to a preset time length, such as every 1 minute, every 5 minutes, or every 10 minutes.

[0074] In the technical solution of the above embodiment, user interaction information data from the live streaming website is first acquired in real time, and this data is divided into multiple time windows according to a preset time period. In this embodiment, a time window is set at 30 seconds, and the system continuously collects interactive behaviors such as bullet comments, comments, likes, and rewards from all users in the live streaming room.

[0075] S2. Evaluate the content consistency of interactive information data within each time window and identify consistent interactive content. In this embodiment, content consistency refers to the degree of similarity or sameness of interactive content in terms of semantics, theme, or expression within a specific time window. Consistent interactive content is mainly characterized by interactive content that is identified as having highly similar or identical characteristics after content consistency evaluation.

[0076] In the technical solution of the above embodiments, the consistency of interactive information data within each time window is evaluated to identify consistent interactive content. In this embodiment, within a time window, the system can perform text similarity analysis on all bullet screen content, or perform pattern matching on the amount and type of virtual items given as rewards. If a large number of users are found to send bullet screens with highly similar content within a short period of time, or to give the same virtual items with a specific amount, this content is identified as consistent interactive content. The evaluation of content consistency can be achieved in various ways, including: using text deduplication based on hash algorithms to regard texts with similarity higher than a certain threshold as consistent; or using semantic analysis models to identify different expressions conveying the same intent.

[0077] S3. Calculate the frequency of occurrence of consistent interactive content within the time window to obtain the burst density of consistent interactive content. In this embodiment, the burst density is mainly represented by the frequency of occurrence of consistent interactive content within a specific time window, reflecting the concentration and intensity of the spread of consistent interactive content.

[0078] In the technical solution of the above embodiments, the frequency of occurrence of consistent interactive content within a time window is calculated to obtain the burst density of consistent interactive content. Specifically, in this embodiment, if 50 bullet comments are identified as consistent interactive content within a 30-second time window, then its burst density is 50 comments / 30 seconds. Burst density is an important indicator for measuring the speed and scale of content dissemination; a high burst density often indicates potential collaborative behavior. The calculation of burst density can be achieved simply by counting, or it can be modeled using more complex statistical models, such as Poisson distribution or negative binomial distribution, to model its frequency of occurrence.

[0079] S4. Extract and evaluate the user account feature information that sent the consistent interaction content to obtain the source features of the consistent interaction content. In this embodiment, the user account feature information includes, but is not limited to, user registration time, historical behavior records, IP address, device fingerprint, etc., which are used to evaluate the source credibility of the interaction content. The source features are mainly obtained by evaluating the user account feature information and are attributes about the source of the consistent interaction content, such as whether it comes from a newly registered account or whether there are batch operations.

[0080] In the technical solution of the above embodiments, the live streaming website checks whether the user accounts sending these consistent interactive content (such as bullet comments, comments, likes, and rewards) are newly registered accounts, whether there is batch registration, whether the IP addresses are highly concentrated, and whether the historical behavior is abnormal. These features are used to determine whether the consistent interactive content is initiated by a small number of malicious accounts or bot accounts. The extraction of source features can include analysis of multiple dimensions such as user registration information, login IP, device fingerprint, and historical interactive behavior; the evaluation method can use machine learning models, such as classifiers, to determine the risk level of the account based on these features.

[0081] S5. Based on the outbreak density, source characteristics, and real-time interactive content of the live streaming website, determine whether there is any illegal coordinated action; in this embodiment, illegal coordinated action refers to the behavior of multiple online users that violates platform rules or laws and regulations by coordinating their actions, such as spamming, malicious attacks, and spreading false information.

[0082] In the technical solutions of the above embodiments, if the density of consistent interactive content is extremely high within a certain time window, and the user accounts sending these interactive contents generally have abnormal characteristics such as newly registered accounts and concentrated IP addresses, and at the same time, sensitive topics are being discussed in the live broadcast room, the system may determine that there is illegal collaborative behavior.

[0083] S6. If there is any illegal collaborative action, the preset handling plan will be implemented for the illegal collaborative action. In this embodiment, the preset handling plan is set in advance by the platform, including handling plans such as warning, mute, account suspension, and content deletion.

[0084] In the technical solutions of the above embodiments, if there is any illegal collaborative action, a preset handling plan is executed for the illegal collaborative action. For example, the accounts involved can be muted or banned, or the relevant interactive content can be deleted; the judgment process can use rule engines, expert systems or machine learning models, and the execution of the handling plan can be automated or executed after manual review.

[0085] In summary, the website information review and control method proposed in this application acquires and analyzes user interaction information data in real time, divides the data into time windows, and performs content consistency assessment on the interaction information data within each time window to identify consistent interaction content. By calculating the burst density of consistent interaction content and extracting the user account feature information that sent the consistent interaction content, the source characteristics are obtained, and the propagation speed, scale, and source reliability of the interaction content are comprehensively considered. Finally, based on the burst density, source characteristics, and real-time interaction content of the live streaming website, the live streaming website can effectively determine whether there is any illegal collaborative action and promptly execute the preset handling plan. This accurately captures illegal collaborative actions by malicious users that circumvent review through homophones, word splitting, or specific behavioral combinations, dynamically adapts to the real-time and interactive nature of the website's live streaming content, and discovers and handles illegal collaborative actions by analyzing the data within the time window in real time, effectively improving the accuracy and timeliness of review and significantly improving the ecosystem of the live streaming website.

[0086] In some alternative embodiments, in practical applications, relying solely on the burst density and source characteristics of interactive content may not be sufficient to effectively identify illegal collaborative actions carried out through decentralized and covert behavioral patterns. In particular, when facing malicious users with high evasion capabilities, traditional judgment methods may be at risk of misjudgment or omission. Figure 2 This is a flowchart illustrating step S5 according to an exemplary embodiment. (Refer to...) Figure 2 Step 105 includes:

[0087] S51. Real-time capture of the interactive behavior time points of each online user on the live streaming website, generating an online user activity time series; In this embodiment, the system continuously monitors and records every interactive behavior of online users on the live streaming website, such as sending bullet comments, liking, sending gifts, commenting, etc., and accurately records the timestamps of these behaviors. By aggregating these time points by user, an activity time series for each online user can be generated, which reflects the user's activity pattern within a specific time period.

[0088] S52. The activity time series of online users is converted into a behavioral rhythm vector within a preset rhythm analysis window. In this embodiment, the discrete interaction time points of users are then aggregated and quantified within a fixed-length time window (i.e., the rhythm analysis window) to transform them into a numerical vector that can characterize the rhythm and intensity of user behavior. For example, the rhythm analysis window can be divided into smaller time slices, and the number or type of interaction behavior in each time slice can be counted to construct the behavioral rhythm vector.

[0089] S53. Calculate the similarity between the behavioral rhythm vectors of online users within the rhythm analysis window, and identify online user groups with synchronized behavioral rhythms based on the similarity to obtain synchronized action groups. In this embodiment, a preset similarity algorithm (such as cosine similarity, Euclidean distance, dynamic time warping, etc.) is used to quantify the similarity between the behavioral rhythm vectors of different users, thereby identifying users whose behavioral patterns are highly consistent or synchronized. These users may be engaging in illegal collaborative actions. Based on the similarity, online user groups with synchronized behavioral rhythms can be identified to obtain synchronized action groups: for example, when the similarity between the behavioral rhythm vectors of two or more users exceeds a preset threshold, they can be considered to belong to the same synchronized action group.

[0090] S54. Retrieve the interactive content sent by all online user groups within the synchronized action group in the rhythm analysis window, and perform semantic analysis on the interactive content to identify the collective intent of the synchronized action group. In this embodiment, the interactive content sent by all online user groups within the synchronized action group in the rhythm analysis window is retrieved, and semantic analysis is performed on the interactive content to identify the collective intent of the synchronized action group. While focusing on the time of user behavior, the specific content sent by these synchronized action groups is also analyzed. Subsequently, semantic analysis of the interactive content is performed through natural language processing (NLP) to reveal whether there is a common purpose or intent behind these groups, such as whether they are engaging in illegal activities such as spamming, malicious attacks, or false advertising.

[0091] S55. Based on the size of the synchronized action group, the collective intent, and the historical behavioral characteristics of the online user group, determine whether there is any illegal coordinated action. In this embodiment, the group size reflects the influence of the coordinated action, the collective intent reflects the nature of the action, and the historical behavioral characteristics reflect the credibility background of the user's behavior. For example, if a user in a group has multiple violation records, the risk of violation of their current synchronized action is higher. Thus, by integrating multi-dimensional information, a comprehensive and accurate determination of illegal coordinated action can be made.

[0092] In the technical solution of the above embodiment, assuming that in a live broadcast room, the system detects that multiple users frequently send similar bullet comments within a short period of time, but the density of these bullet comments has not reached the violation threshold of traditional methods, and their source characteristics do not show obvious abnormalities, traditional review methods will not react. Applying the review control method of this embodiment, firstly, the interactive behaviors of these users, such as the time of sending bullet comments and the time of liking, are captured in real time, and their respective activity time series are generated; then, within a preset rhythm analysis window, these time series are converted into behavioral rhythm vectors. For example, if the rhythm analysis window is 1 minute, the system can count the number of bullet comments sent and the number of likes every 5 seconds, constructing a 12-dimensional behavioral rhythm vector. Next, the system calculates the similarity between the user behavior rhythm vectors and finds that the behavior rhythm vectors of five users have extremely high similarity, indicating that their interaction behavior is highly synchronized in time, thus identifying these five users as a synchronized action group. Then, the system retrieves all the bullet screen content sent by these five users in the rhythm analysis window and performs semantic analysis, finding that although the wording of these bullet screen contents is slightly different, their core intent is to maliciously attack the streamer or falsely promote specific products. Finally, combining the group size of these five users, the identified collective intent of malicious attack, and their past violation history (for example, two of the users had been warned for spamming), the system determines that these five users are engaged in illegal coordinated action and immediately activates the preset handling plan, muting or banning these users. In this way, this application can effectively identify more covert illegal coordinated actions that are difficult to detect by traditional methods, making the judgment results more comprehensive and accurate, greatly reducing the false positive and false negative rates, providing live streaming websites with a more intelligent and robust review and control mechanism, and effectively maintaining platform order and user experience.

[0093] In some alternative embodiments, due to the possible deviation of local clocks of different user devices and the uncertainty of network transmission delay, the directly obtained interaction behavior time points may not accurately reflect the actual occurrence sequence and synchronicity of events, which may lead to errors in the judgment of user behavior synchronicity in subsequent behavior rhythm analysis, thereby affecting the accurate identification of illegal collaborative actions. Figure 3 This is a flowchart illustrating step S51 according to an exemplary embodiment. (Refer to the attached document.) Figure 3 Step S51 includes:

[0094] S511. Retrieve the local timestamp of each online user's interactive behavior within the live streaming website and the global timestamp of the global time synchronization server; In this embodiment, the local timestamp is the time when the interactive behavior occurs, which is recorded locally on the user device, and the global timestamp is the standard time provided by an authoritative time server.

[0095] S512. The local timestamp is calibrated based on the global timestamp to obtain the calibration timestamp and the residual error of the local timestamp. The calibration strategy for subsequent timestamps is adjusted based on the residual error. In this embodiment, the local timestamp is calibrated using the global timestamp to eliminate the systematic deviation between the local clock and the standard time. During the calibration process, a residual error in the local timestamp calibration is also generated. The residual error reflects the small difference between the calibrated timestamp and the true global time. When the residual error is large or exhibits a specific pattern, it is necessary to adjust the parameters of the calibration algorithm or switch to a more refined calibration model to improve the adaptability and accuracy of the calibration.

[0096] S513. Obtain historical calibration data and network latency data for each online user, calculate and apply a personalized time calibration factor for each online user, and calibrate the timestamps of interactive behaviors from different online users; wherein, the personalized time calibration factor is a correction parameter customized for a specific user, used to compensate for its local clock deviation and network latency, thereby accurately calibrating the timestamps of interactive behaviors from different online users; in this embodiment, historical calibration data records the clock drift and calibration effect of the user's device in different time periods, and network latency data records the average latency and fluctuation of communication between the user and the server. Based on the historical calibration data and network latency data, calculate and apply the personalized time calibration factor for each online user.

[0097] S514. Associate the calibration timestamp with the interactive behavior of online users to generate a user activity time series; wherein, the user activity time series is a set of user interactive behaviors arranged in calibrated time order; in this embodiment, the calibration timestamp is associated with the interactive behavior of online users, thereby assigning a global time to each interactive behavior and generating a user activity time series.

[0098] In the technical solution of the above embodiment, assume that user A sends a bullet comment on a live streaming website, and the timestamp recorded on their local device is 10:00:05.123. Simultaneously, the current global time obtained from the global time synchronization server is 10:00:05.000. Through comparison, the system finds that the local timestamp is 123 milliseconds ahead of the global timestamp. The system calibrates the local timestamp based on this deviation, obtaining a calibrated timestamp of 10:00:05.000, and records the 123-millisecond residual error. If it is subsequently found that user A's device is frequently 100-150 milliseconds ahead, the system will adjust its calibration strategy, for example, by setting a default negative time offset for the user's device. Furthermore, the system will query user A's historical calibration data, finding that their network latency typically fluctuates between 50-80 milliseconds, and calculate a personalized time calibration factor, for example, subtracting 70 milliseconds of network latency compensation from the calibrated timestamp. Ultimately, user A's bullet comment behavior will be associated with a precise calibration timestamp, such as 10:00:04.930, and their user activity time series will be constructed accordingly. In this way, even if there are clock differences and network latency between different user devices, the time points of their interaction behavior can be accurately synchronized to a unified global timeline.

[0099] The above technical solutions can eliminate the impact of local clock deviation and network latency on timestamps, ensuring that all user interaction behaviors are recorded under a unified global time benchmark. This makes the generated user activity time series more accurately reflect the actual time of user behavior, improve the accuracy of identifying online user groups with synchronized behavioral rhythms, and reduce the risk of misjudging or omitting illegal collaborative actions.

[0100] In some alternative embodiments, Figure 4 This is a flowchart illustrating step S52 according to an exemplary embodiment. (Refer to the attached document.) Figure 4 Step S52 includes:

[0101] S521. Divide the rhythm analysis window into multiple time slices; In this embodiment, the rhythm analysis window is used to observe and analyze the user's interactive behavior on the live streaming website within a continuous time interval. In order to more accurately capture the dynamic changes in user behavior, the rhythm analysis window is divided into multiple time slices, and each time slice is a smaller time unit within the rhythm analysis window. A rhythm analysis window can be divided into several time slices of equal length, each time slice lasting several seconds or tens of seconds.

[0102] S522. Count the number of interactive behaviors included in each time slice, and classify and count them according to the type of interactive behavior to obtain the number of different types of interactive behaviors. In this embodiment, the number of interactive behaviors included in each time slice is counted. Interactive behaviors include, but are not limited to, sending bullet comments, liking, sending gifts, sharing links, and commenting. In order to more comprehensively reflect the characteristics of user behavior, interactive behaviors are also classified according to type to obtain the number of different types of interactive behaviors. For example, the number of bullet comments sent, the number of likes, and the number of gifts sent in a certain time slice can be counted, which will be used later to distinguish the weight of different interactive behaviors in the user behavior pattern.

[0103] S523. Calculate the comprehensive intensity value of interactive behaviors within a time slice based on the number of different types of interactive behaviors within the time slice; wherein, the comprehensive intensity value is used to quantify the user's activity level and behavior intensity within the time slice; in this embodiment, different weights can be set for different types of interactive behaviors, such as the weight of sending bullet comments being higher than the weight of liking, and the weight of sending gifts being higher than the weight of sending bullet comments, and then the number of each type of interactive behavior is multiplied by its corresponding weight and summed to obtain the comprehensive intensity value.

[0104] S524. The comprehensive intensity value is used as the element value of the corresponding time slice in the behavior rhythm vector to construct the behavior rhythm vector. In this embodiment, each time slice corresponds to a dimension in the behavior rhythm vector, and its value is the comprehensive intensity value in that time slice. Then, the comprehensive intensity values ​​of all time slices are arranged in chronological order to form a vector that can characterize the user's behavior rhythm features in the entire rhythm analysis window.

[0105] The constructed behavioral rhythm vector, through the above technical solution, can accurately depict users' behavioral patterns, improve the discriminative power of the behavioral rhythm vector, thereby more accurately identifying online user groups with synchronized behavioral rhythms, improving the accuracy of judging illegal collaborative actions, and enhancing the robustness of website information review and control methods.

[0106] In some alternative embodiments, Figure 5 This is a flowchart illustrating step S53 according to an exemplary embodiment. (Refer to the attached diagram.) Figure 5 Step S53 includes: including:

[0107] S531. Extract the temporal features of each behavioral rhythm vector to obtain a behavioral pattern feature set. The temporal features include the start time, duration, peak intensity, behavioral type sequence, and behavioral interval distribution of the behavior. In this embodiment, the start time of the behavior refers to the time when the user first performs an interactive behavior within the rhythm analysis window; the duration refers to the total time the user remains in an active interactive state within the rhythm analysis window; the peak intensity refers to the intensity at which the number of interactive behaviors reaches its highest value within a certain time slice; the behavioral type sequence refers to the arrangement of interactive behavior types (such as likes, comments, shares, etc.) performed by the user in chronological order within the rhythm analysis window; and the behavioral interval distribution refers to the statistical regularity of the time interval between consecutive user interactive behaviors.

[0108] S532. Calculate the nonlinear similarity between sets of behavioral pattern features. The nonlinear similarity is obtained by distance calculation or sequence alignment algorithm through dynamic time warping. When calculating the nonlinear similarity, behavioral type weights are introduced according to different types of interactive behaviors. The behavioral type weights are used to reflect the importance of different types of interactive behaviors in the expression of collective intent.

[0109] In this embodiment, nonlinear similarity can be obtained through distance calculation using dynamic time warping or sequence alignment algorithms. Dynamic time warping can match two sequences by "bending" the time axis, thus accurately measuring their similarity even with time offsets. Sequence alignment algorithms, on the other hand, focus on identifying common patterns and differences between two behavioral sequences. When calculating nonlinear similarity, behavior type weights are introduced to more accurately reflect the importance of different interactive behaviors in the expression of collective intent. For example, posting a sensitive comment is given a higher weight than liking, as it more directly reflects the user's intent. Specifically, behavior type weights can be set and dynamically adjusted based on historical data, expert experience, or machine learning models.

[0110] S533. Monitor the volatility of nonlinear similarity and adjust and optimize the parameters or weights of nonlinear similarity calculation based on the volatility. Volatility refers to the instability or regularity of the similarity calculation results over time or with changes in input data. In this embodiment, by analyzing the volatility, abnormal similarity change patterns can be identified, such as sudden drops or rises, or periodic spoofing fluctuations. Based on the volatility, the parameters or weights of nonlinear similarity calculation can be dynamically adjusted and optimized, thereby improving sensitivity to potential illegal collaborative actions or reducing the false alarm rate.

[0111] Furthermore, in this embodiment, monitoring the volatility of nonlinear similarity includes: acquiring the calculation results of nonlinear similarity in real time; performing time-series analysis on the calculation results to extract the volatility frequency, volatility amplitude, and volatility duration of the obtained calculation results; and identifying whether there are periodic fluctuations or discontinuous changes in the calculation results based on the volatility frequency, volatility amplitude, and volatility duration.

[0112] The fluctuation frequency refers to the rate at which the similarity value changes within a specific time period, such as the number of fluctuations per minute or hour. The fluctuation amplitude refers to the range of change in the similarity value from peak to trough or from trough to peak, reflecting the intensity of the fluctuation. The fluctuation duration refers to the length of time a significant fluctuation lasts from beginning to end. These features can be extracted using time series analysis methods such as Fourier transform, wavelet analysis, and autocorrelation function. Identifying whether there are periodic fluctuations or discontinuous changes in the calculation results based on the fluctuation frequency, amplitude, and duration involves analyzing the extracted fluctuation characteristics to determine whether the nonlinear similarity sequence exhibits a regular periodic pattern, such as fixed fluctuations daily or weekly, or whether there are sudden, unexpected jumps or interruptions, i.e., discontinuous changes. Periodic fluctuations generally represent a regular user behavior pattern, while discontinuous changes may indicate an abnormal event.

[0113] In the technical solution of the above embodiment, it is assumed that in a certain live streaming website, there are users A and B, who both interact within the rhythm analysis window. First, the temporal features of the behavioral rhythm vectors of users A and B are extracted. For user A, the temporal features may include: a start time of 10 seconds after the window opens, a duration of 30 seconds, a peak intensity of 5 comments sent at the 20th second, a behavior type sequence of "like-comment-comment-share-comment," and a behavior interval distribution showing an interaction pattern of once every 5 seconds. Similarly, the corresponding temporal features of user B are also extracted.

[0114] Next, the system calculates the non-linear similarity between the sets of behavioral pattern features of user A and user B. For example, a dynamic time warping algorithm can be used to compare the behavioral type sequences of user A and user B. Even if user A likes a post at the 10th second and user B likes a post at the 12th second, the dynamic time warping algorithm can still identify this near-synchronous timing. During the calculation, if the behavior type "comment" is given a higher weight (e.g., a weight of 3) and "like" has a weight of 1, then when both user A and user B frequently post comments, their similarity score will significantly increase, because comments are considered to better reflect collective intent.

[0115] Finally, the system continuously monitors the calculation results of this non-linear similarity. If, within a certain time period, the similarity of a large number of user groups suddenly and rapidly rises from a low level to a high level, and this rise persists for a period of time, the system will identify this volatility. Based on this volatility, the system may automatically adjust the parameters of the non-linear similarity calculation, for example, by tightening the matching window of the dynamic time warping algorithm, or by further increasing the weight of certain high-risk behavior types (such as "spam comments"), to more sensitively capture potential illegal coordinated actions and reduce the false positive rate. In this way, it dynamically adapts to complex interactive environments, thereby effectively improving the accuracy of identifying illegal coordinated actions.

[0116] S534. If periodic fluctuations or discontinuous changes exist, the system combines historical fluctuation data from the live streaming website to determine whether the fluctuations are spoofed. In this embodiment, when periodic fluctuations or discontinuous changes are detected, the audit control method does not immediately consider them abnormal. Instead, it further compares and analyzes them with historical fluctuation data from the live streaming website. This historical fluctuation data includes nonlinear similarity fluctuation patterns of the live streaming website under normal operating conditions and when known illegal collaborative actions occur. Through this comparison, it can be determined whether the currently detected fluctuation belongs to a normal, known fluctuation pattern, or a known spoofed fluctuation pattern, thereby identifying potential evasion behaviors.

[0117] In some alternative embodiments, Figure 6 This is a partial flowchart illustrating step S534 according to an exemplary embodiment. (Refer to...) Figure 6 Step S534 includes:

[0118] S5341. The sequence of calculation results is acquired in real time, and the changing trend between adjacent time points and the fluctuation pattern in different time periods are identified to obtain trend features and local fluctuation patterns. In this embodiment, the time-series data stream of nonlinear similarity calculation results is received in real time to identify whether the trend of nonlinear similarity value is rising, falling or remaining stable in a very short time interval; and the overall change pattern of nonlinear similarity value in a longer time window, such as continuous high level, periodic fluctuation, sudden peak or slow decay, etc., so as to obtain more refined trend features and local fluctuation patterns.

[0119] S5342. Correlation analysis is performed between trend characteristics and local fluctuation patterns to obtain multi-stage fluctuation patterns. In this embodiment, a short-term local fluctuation may be part of a specific stage in the long-term trend. Through correlation analysis, a more complex and comprehensive multi-stage fluctuation pattern can be constructed, which can reflect the behavioral evolution and strategy adjustment of coordinated actions at different time scales.

[0120] S5343. Import the multi-stage fluctuation pattern into a preset avoidance strategy pattern library for comparison to determine whether the fluctuation is a disguised fluctuation. In this embodiment, the avoidance strategy pattern library comparison uses known malicious behavior patterns to identify potential disguised behaviors. The avoidance strategy pattern library can pre-store a variety of known cooperative action patterns used to avoid detection, such as "slow penetration", "intermittent bursts", "disguised normal interaction", etc. By comparing the currently identified multi-stage fluctuation pattern with the patterns in the library, the similarity between the current fluctuation and the known disguise strategy is evaluated, thereby determining whether the fluctuation is a disguised fluctuation.

[0121] In the technical solution of the above embodiment, it is assumed that a live streaming website continuously monitors the nonlinear similarity of online user behavior rhythm vectors. That is, within a certain period of time, the nonlinear similarity value begins to show a regular decrease and increase, with a fluctuation frequency of about twice per hour, a fluctuation amplitude between 0.1 and 0.3, and each fluctuation lasting about 10 minutes. If the parameters are adjusted only based on the fluctuation, traditional audit control methods may identify it as a normal periodic change in user activity.

[0122] The audit control method proposed in this application further performs time-series analysis on these fluctuation characteristics and compares them with historical fluctuation data of the live streaming website. For example, historical data shows that under normal circumstances, the non-linear similarity fluctuation frequency of the live streaming website is usually low and the amplitude is small, or similar periodic fluctuations only occur during specific marketing activities. Through comparison, it is found that the currently detected fluctuation pattern is highly consistent with the disguised fluctuation pattern exhibited by a known "brushing" or "comment control" group in the past when they were conducting coordinated actions. For example, this disguised fluctuation pattern may manifest as the similarity of the interaction rhythm of multiple user accounts showing synchronous, but deliberately designed to be less abrupt periodic changes in order to simulate the activity fluctuations of a normal user group. Through this in-depth analysis, the system can accurately determine that the currently detected fluctuation is not a normal periodic change, but a disguised fluctuation caused by illegal coordinated actions, thereby triggering corresponding handling measures to further review the user accounts suspected of violating regulations or restrict their interaction permissions.

[0123] In some alternative embodiments, simple pattern comparison may not be effective in identifying elaborately designed, highly complex, or novel camouflaged fluctuations, especially as collaborating actors continuously evolve their evasion strategies. The pre-defined pattern library may not cover all potential camouflage patterns, leading to missed detections or inefficient detection. Step S5343 specifically includes:

[0124] Multi-dimensional features of multi-stage fluctuation patterns are extracted. These features include the complexity of the behavioral pattern, the entropy of the behavioral sequence, and the sparsity of the behavioral pattern. In this embodiment, the complexity of the behavioral pattern can be understood as the structural complexity of the interactive behavioral sequence, which can be quantified, for example, by calculating Lempel-Ziv complexity or Kolmogorov complexity, to identify cooperative actions disguised by increasing behavioral diversity or irregularity. The entropy of the behavioral sequence refers to the degree of uncertainty or randomness of information in the interactive behavioral sequence, which can be measured, for example, by Shannon entropy, to distinguish normal random behavior from deliberately created low-entropy or high-entropy disguised behavior. The sparsity of the behavioral pattern refers to the frequency or density of interactive behavior in a specific time slice or behavior type, thereby capturing strategies that evade detection by sparsifying or centralizing specific behaviors.

[0125] By performing nonlinear mapping and dimensionality reduction on the features of multidimensional features and patterns in the avoidance strategy pattern library, projected fluctuation patterns are obtained. In this embodiment, nonlinear mapping maps data in the high-dimensional feature space to the low-dimensional space through nonlinear transformation. For example, algorithms such as kernel principal component analysis (KPCA), t-distributed random neighborhood embedding (t-SNE), or uniform manifold approximation and projection (UMAP) can be used to reveal the potential nonlinear structure and relationships in the data, making it easier to distinguish different types of fluctuation patterns in the low-dimensional space. Dimensionality reduction reduces the feature dimension while retaining the main information of the data, thereby reducing computational complexity and improving visualization.

[0126] By analyzing the distribution density and cluster dispersion of projected wave patterns in a low-dimensional feature space, difference points are identified. These difference points are isolated points that do not belong to known pattern clusters or newly formed cluster centers. In this embodiment, the distribution density refers to the density of projected wave pattern points within a certain region in the low-dimensional space, while the cluster dispersion reflects the tightness or dispersion of these pattern points forming clusters. Difference points are isolated points in the low-dimensional feature space that do not belong to any known evasion strategy pattern clusters, or they form new cluster centers that have not been identified by the existing pattern library, thereby discovering evasion strategies that are significantly different from or entirely new to known camouflage patterns.

[0127] The difference point is compared with a preset difference threshold to determine whether the fluctuation is a masquerade fluctuation. In this embodiment, the difference threshold is a critical value set based on historical data and expert experience, which is used to quantify the degree of deviation between a fluctuation pattern and a known normal pattern or a known masquerade pattern. If the distance between the difference point and the known pattern exceeds the difference threshold, the fluctuation is considered to be highly abnormal, and thus it is determined to be a masquerade fluctuation.

[0128] In the technical solution of the above embodiments, it is assumed that in a live streaming website, there is a group of users attempting to circumvent censorship by posting seemingly irregular but actually coordinated interactive content. First, the multi-stage fluctuation patterns of these users are obtained using the method described above. Then, multi-dimensional features are extracted from these multi-stage fluctuation patterns; for example, the average length of messages sent by users within a specific time period, the entropy value of the frequency of emoji usage, and the sparsity of the appearance of specific sensitive words can be calculated. These multi-dimensional features together constitute a high-dimensional vector.

[0129] Subsequently, these high-dimensional feature vectors are input into a nonlinear dimensionality reduction algorithm, such as t-SNE, to map them into a two-dimensional or three-dimensional low-dimensional feature space, forming projected fluctuation patterns. In the low-dimensional space, the distribution of these projected fluctuation pattern points is analyzed. The interaction patterns of normal users may cluster in certain areas, while the interaction patterns of known masquerading patterns will form other specific clusters. When the projected fluctuation pattern points of a group of users appear as isolated points far away from all known normal or masquerading pattern clusters in the low-dimensional space, or form a completely new, previously unidentified tight cluster center, these points are identified as dissimilar points.

[0130] Finally, the system calculates the distance from these discrepancy points to the nearest known pattern cluster and compares this distance with a preset discrepancy threshold. If the distance exceeds the threshold, the system determines that the user interaction fluctuations are spoofing. For example, if the system discovers that the interaction behavior of a user group forms a new, highly discrete cluster in a low-dimensional space, and that this cluster is significantly distant from all known normal or illegal pattern clusters, the system will mark it as a potential spoofed collaborative action and trigger corresponding handling measures. The audit control method in this embodiment can effectively identify violators even when they employ unprecedented evasion strategies through the inherent anomalies in their behavioral patterns.

[0131] In summary, the website information review and control method provided in Embodiment 1 of this application, by acquiring user interaction information data from a live streaming website in real time and dividing it into time windows, assesses the content consistency of the interaction information data within each time window, identifies consistent interaction content, and calculates its burst density, can effectively identify concealed illegal information that bursts out in a short period of time and has high consistency. Subsequently, by combining user account feature information with burst density and real-time interaction content of the live streaming website, it can effectively comprehensively determine whether there is any illegal collaborative action. If illegal collaborative action is found, a preset handling plan is executed, thereby quickly processing illegal information that is concealed and transmitted through real-time interaction by malicious users. This effectively solves the technical problem of difficulty in identifying and processing concealed illegal collaborative actions in real-time interactive live streaming content in the prior art, and significantly improves the accuracy and timeliness of website information review.

[0132] Example 2

[0133] Embodiment 2 of this application provides a website information review and control system, the control system including:

[0134] The acquisition module is used to acquire user interaction information data from the live streaming website in real time and divide the interaction information data into multiple time windows according to a preset time length.

[0135] The evaluation module is used to assess the consistency of interactive information data within each time window and identify consistent interactive content.

[0136] The calculation module is used to calculate the frequency of occurrence of consistent interactive content within a time window, and to obtain the burst density of consistent interactive content.

[0137] The feature evaluation module is used to extract and evaluate the feature information of user accounts that send consistent interactive content, and obtain the source features of consistent interactive content.

[0138] The judgment module is used to determine whether there is any illegal coordinated action based on the outbreak density, source characteristics, and real-time interactive content of the live streaming website.

[0139] The handling module is used to execute a preset handling plan for any illegal collaborative actions.

[0140] The website information review and control system provided in Embodiment 2 of this application acquires user interaction information data from a live streaming website in real time and divides it into time windows. It then evaluates the consistency of the interaction information data within each time window, identifies consistent interaction content, and calculates its burst density. This effectively identifies highly consistent hidden violations that burst in a short period of time. Subsequently, by combining user account feature information with the burst density and the real-time interaction content of the live streaming website, it can effectively and comprehensively determine whether there is any illegal collaborative action. If illegal collaborative action is found, a preset handling plan is executed. This allows for rapid processing of illegal information that malicious users transmit covertly through real-time multi-party interaction, effectively solving the technical problem of difficulty in identifying and processing hidden illegal collaborative actions in real-time interactive live streaming content in the prior art, and significantly improving the accuracy and timeliness of website information review.

[0141] Example 3

[0142] Embodiment 3 of this application provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the website information audit control method provided in the first aspect above.

[0143] The readable storage medium may be more specifically adopted, including but not limited to: portable disk, hard disk, random access memory, read-only memory, erasable programmable read-only memory, optical storage device, magnetic storage device, or any suitable combination thereof.

[0144] The program code for executing the present invention can be written in any combination of one or more programming languages. The program code can be executed entirely on the user device, partially on the user device, as a standalone software package, partially on the user device and partially on a remote device, or entirely on a remote device.

[0145] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0146] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A website information review and control method, characterized in that, The method includes: Real-time acquisition of user interaction information data from live streaming websites, and division of the interaction information data into multiple time windows according to a preset time length; The process involves evaluating the consistency of interactive information data within each time window and identifying consistent interactive content. This includes: capturing the real-time interaction time points of each online user on the live streaming website to generate an online user activity time series; converting the online user activity time series into behavioral rhythm vectors within a preset rhythm analysis window; calculating the similarity between the behavioral rhythm vectors of online users within the rhythm analysis window, and identifying online user groups with synchronized behavioral rhythms based on the similarity to obtain synchronized action groups; retrieving the interactive content sent by all online user groups within the synchronized action group within the rhythm analysis window, performing semantic analysis on the interactive content to identify the collective intent of the synchronized action group; and determining whether there is any illegal collaborative action based on the size of the synchronized action group, the collective intent, and the historical behavioral characteristics of the online user group. Calculate the frequency of occurrence of the consistent interaction content within the time window to obtain the burst density of the consistent interaction content; Extract and evaluate the user account feature information that sent the consistent interaction content to obtain the source features of the consistent interaction content; Based on the outbreak density, the source characteristics, and the real-time interactive content of the live streaming website, it is determined whether there is any illegal coordinated action. If there is illegal coordinated action, a preset handling plan is implemented for the illegal coordinated action. The process of converting the online user's activity time series into a behavioral rhythm vector within a preset rhythm analysis window includes: The rhythm analysis window is divided into multiple time slices; The number of interactive behaviors contained in each time slice is counted, and the interactive behaviors are classified and counted according to their types to obtain the number of different types of interactive behaviors; Based on the number of different types of interactive behaviors within the time slice, calculate the comprehensive intensity value of the interactive behaviors within the time slice; The behavior rhythm vector is constructed by using the comprehensive intensity value as the element value of the corresponding time slice in the behavior rhythm vector.

2. The website information review and control method according to claim 1, characterized in that, The real-time capture of each online user's interactive behavior time points within the live streaming website, generating a user activity time series, includes: Retrieve the local timestamp of each online user's interaction behavior within the live streaming website and the global timestamp of the global time synchronization server; The local timestamp is calibrated based on the global timestamp to obtain the calibration timestamp and the residual error of calibrating the local timestamp, and the calibration strategy for subsequent timestamps is adjusted based on the residual error. Acquire historical calibration data and network latency data for each online user, calculate and apply personalized time calibration factors for each online user, and calibrate the timestamps of interactive behaviors from different online users. The calibration timestamps are correlated with the interactive behaviors of online users to generate a time series of user activities.

3. The website information review and control method according to claim 1, characterized in that, The calculation of the similarity between the behavioral rhythm vectors of online users within the rhythm analysis window includes: Extract the temporal features of each of the behavioral rhythm vectors to obtain a behavioral pattern feature set, wherein the temporal features include the start time, duration, peak intensity, behavioral type sequence, and behavioral interval distribution of the behavior; Calculate the nonlinear similarity between the sets of behavioral pattern features; Monitor the volatility of the nonlinear similarity and adjust or optimize the parameters or weights for calculating the nonlinear similarity based on the volatility.

4. The website information review and control method according to claim 3, characterized in that, Monitoring the volatility of the nonlinear similarity includes: The calculation results of the nonlinear similarity are obtained in real time; Time series analysis of the calculation results is performed to extract the fluctuation frequency, fluctuation amplitude, and fluctuation duration of the calculation results; Based on the fluctuation frequency, the fluctuation amplitude, and the fluctuation duration, identify whether there are periodic fluctuations or discontinuous changes in the calculation results; If the periodic fluctuations or discontinuous changes exist, the historical fluctuation data of the live streaming website will be used to determine whether the fluctuations are spoofed.

5. The website information review and control method according to claim 4, characterized in that, If the periodic fluctuations or discontinuous changes exist, the determination of whether the fluctuations are spoofed fluctuations, based on the historical fluctuation data of the live streaming website, includes: The sequence of the calculation results is acquired in real time, and the changing trends between adjacent time points and the fluctuation patterns in different time periods are identified to obtain trend characteristics and local fluctuation patterns. By correlating the trend characteristics with the local fluctuation patterns, multi-stage fluctuation patterns are obtained. The multi-stage fluctuation pattern is imported into a preset avoidance strategy pattern library for comparison to determine whether the fluctuation is a disguised fluctuation.

6. The website information review and control method according to claim 5, characterized in that, The step of importing the multi-stage fluctuation pattern into a preset avoidance strategy pattern library for comparison to determine whether the fluctuation is a disguised fluctuation includes: Extract multi-dimensional features of the multi-stage fluctuation pattern, wherein the multi-dimensional features include the complexity of the behavior pattern, the entropy value of the behavior sequence, and the sparsity of the behavior pattern. The multi-dimensional features are nonlinearly mapped and dimensionality-reduced with the features of the patterns in the avoidance strategy pattern library to obtain the projected fluctuation pattern. The distribution density and cluster dispersion of the projected wave pattern in the low-dimensional feature space are analyzed to identify the difference points, wherein the difference points are isolated points that do not belong to the known pattern clusters or newly formed cluster centers. The difference points are compared with a preset difference threshold to determine whether the fluctuation is a masquerade fluctuation.

7. A website information review and control system, characterized in that, The control system includes: The acquisition module is used to acquire user interaction information data from the live streaming website in real time and divide the interaction information data into multiple time windows according to a preset time length; The evaluation module is used to assess the consistency of the interactive information data within each time window and identify consistent interactive content. This includes: capturing the real-time interaction time points of each online user on the live streaming website to generate an online user activity time series; converting the online user activity time series into behavioral rhythm vectors within a preset rhythm analysis window; calculating the similarity between the behavioral rhythm vectors of online users within the rhythm analysis window, and identifying online user groups with synchronized behavioral rhythms based on the similarity, thus obtaining synchronized action groups; retrieving the interactive content sent by all online user groups within the synchronized action group within the rhythm analysis window, and performing semantic analysis on the interactive content to identify the collective intent of the synchronized action group; and determining whether there is any illegal collaborative action based on the size of the synchronized action group, the collective intent, and the historical behavioral characteristics of the online user group. The calculation module is used to calculate the frequency of occurrence of the consistent interaction content within the time window, and to obtain the burst density of the consistent interaction content. The feature evaluation module is used to extract and evaluate the user account feature information that sent the consistent interaction content, and obtain the source feature of the consistent interaction content. The determination module is used to determine whether there is any illegal coordinated action based on the outbreak density, the source characteristics, and the real-time interactive content of the live streaming website. The handling module is used to execute a preset handling plan for any illegal collaborative actions. The process of converting the online user's activity time series into a behavioral rhythm vector within a preset rhythm analysis window includes: The rhythm analysis window is divided into multiple time slices; The number of interactive behaviors contained in each time slice is counted, and the interactive behaviors are classified and counted according to their types to obtain the number of different types of interactive behaviors; Based on the number of different types of interactive behaviors within the time slice, calculate the comprehensive intensity value of the interactive behaviors within the time slice; The behavior rhythm vector is constructed by using the comprehensive intensity value as the element value of the corresponding time slice in the behavior rhythm vector.

8. A computer-readable storage medium, characterized in that, It stores computer instructions, which, when executed, perform the steps of the website information review and control method according to any one of claims 1-6.

Images