A Real-Time Source Tracing Method and System for Live Stream Hotlinking Based on Multi-Source Heterogeneous Signaling Fusion

Abstract

This invention discloses a method and system for real-time tracing of live stream hotlinking based on multi-source heterogeneous signaling fusion. The method includes multi-source heterogeneous signaling acquisition, multi-source heterogeneous signaling feature extraction, construction of a hotlinking adaptation loss function, hotlinking tracing model design, parameter dynamic optimization, and real-time hotlinking determination of live streams. This invention belongs to the field of data processing, specifically referring to a method and system for real-time tracing of live stream hotlinking based on multi-source heterogeneous signaling fusion. This solution constructs a hotlinking adaptation loss function based on the arc-tangent power-law fallback characteristic to adapt to multi-signaling modal noise fluctuations; embeds a risk probability site inversion penalty term to effectively improve the reliability of real-time hotlinking tracing of live streams; and constructs a full-process prevention and control system: designs a parameter dynamic optimization strategy driven by inversion rate to dynamically adapt to data fluctuations, and establishes a structure-gradient dual-dimensional inversion control mechanism to avoid inversion risks throughout the entire link from model structure design to parameter gradient optimization, significantly improving the hotlinking tracing effect.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a method and system for real-time source tracing of live stream hotlinking based on multi-source heterogeneous signaling fusion. Background Technology

[0002] Real-time source tracing methods for live stream hotlinking refer to technical means of collecting and analyzing multi-source data related to live streams, identifying abnormal characteristics and hotlinking behavior patterns, locating the source of hotlinking in real time, and determining the risk of hotlinking. However, general real-time source tracing methods for live stream hotlinking are difficult to cope with noise fluctuations in multi-signaling data in live streams, and high-value signaling information is easily masked by noise, resulting in poor reliability of hotlinking tracing results. Furthermore, general real-time source tracing methods for live stream hotlinking have weak adaptability to live stream data fluctuations, are prone to logical conflicts, and exacerbate the risk of probabilistic site inversions, leading to poor tracing effectiveness. Summary of the Invention

[0003] To address the above issues and overcome the shortcomings of existing technologies, this invention provides a real-time source tracing method and system for live stream hotlinking based on multi-source heterogeneous signaling fusion. Addressing the problem that general real-time source tracing methods for live stream hotlinking struggle to handle noise fluctuations in multi-signaling data and that high-value signaling information is easily masked by noise, leading to poor reliability of hotlinking tracing results, this solution constructs a hotlinking adaptation loss function based on the arc-tangent power-law fallback characteristic to adapt to multi-signaling modal noise fluctuations and ensure optimized stability. It calculates signaling adaptation coefficients based on the signal-to-noise ratio of each modality, distinguishes the value of modal information, and balances error contributions. It also embeds risk estimation... The inversion penalty term at the rate point constrains the monotonicity of the risk level, effectively improving the reliability of real-time source tracing for live stream hotlinking. Addressing the issues of weak adaptability to live stream data fluctuations and logical conflicts in general real-time source tracing methods, which exacerbate the risk of inversion at probabilistic points and lead to poor tracing results, this solution constructs a comprehensive prevention and control system: It designs a parameter dynamic optimization strategy driven by the inversion rate to dynamically adapt to data fluctuations, balancing convergence efficiency and training stability; and establishes a structure-gradient dual-dimensional inversion control mechanism to avoid inversion risks throughout the entire process from model structure design to parameter gradient optimization, significantly improving the effectiveness of hotlinking source tracing.

[0004] The technical solution adopted by this invention is as follows: The real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion provided by this invention includes the following steps:

[0005] Step S1: Acquisition of multi-source heterogeneous signaling;

[0006] Step S2: Extraction of features from multi-source heterogeneous signaling;

[0007] Step S3: Constructing the hotlinking adaptation loss function;

[0008] Step S4: Design of the hotlinking tracing model;

[0009] Step S5: Dynamic parameter optimization;

[0010] Step S6: Real-time source tracing and determination of live stream hotlinking.

[0011] Further, in step S1, the multi-source heterogeneous signaling acquisition involves acquiring historical multi-source heterogeneous signaling data, including flow signaling modal data, device fingerprint signaling modal data, and network behavior signaling modal data; performing spatiotemporal logical alignment and missing value processing on the multi-source data, and simultaneously labeling the data; thus obtaining a multi-source heterogeneous signaling set.

[0012] Further, in step S2, the multi-source heterogeneous signaling feature extraction specifically includes:

[0013] For single-source signaling feature extraction, convolutional neural networks are used to extract deep visual features for network behavior signaling modal data to capture abnormal patterns in network transmission. For flow signaling modal data, a Transformer encoder is used to extract semantic features to identify abnormal signaling fields. For device fingerprint signaling modal data, standardization is first used to eliminate dimensional differences, and then a fully connected layer is used to extract quantization features to capture abnormal device fingerprints.

[0014] Weighted fusion of multi-source signaling features maps heterogeneous features to a unified feature space, thereby achieving weighted fusion of multi-source signaling features.

[0015] Furthermore, in step S3, the construction of the hotlinking adaptation loss function specifically includes:

[0016] Define the hotlinking risk prediction error as the error between the hotlinking risk value predicted by the multi-source signaling fusion feature calculation model and the actual label;

[0017] The hotlinking adaptation loss function is defined by using the exponential decreasing property of the arc tangent formula and combining it with the signaling adaptation coefficient to construct the hotlinking adaptation loss function.

[0018] The risk level inversion penalty term is designed and embedded into the total loss function to measure the degree of monotonicity violation.

[0019] The total loss function is constructed by integrating hotlinking adaptation loss and reverse order penalty term.

[0020] Furthermore, in step S4, the design of the hotlinking tracing model specifically includes:

[0021] The feature enhancement unit design incorporates a self-attention mechanism to enhance the fused features;

[0022] A multi-probability site parallel prediction unit design is proposed, which constructs a deep fully connected network based on enhanced features to achieve parallel output of multi-confidence hotlinking risk values.

[0023] Furthermore, in step S5, the dynamic optimization of parameters involves calculating the inversion rate of risk probability sites in real time during training and adjusting the single-step parameter update magnitude.

[0024] Furthermore, in step S6, the real-time source tracing determination of live stream hotlinking specifically includes:

[0025] Two-dimensional reverse-order active control includes: structural layer constraints, where all risk probability sites share the same set of feature enhancement and fully connected network parameters, and different site predictions are achieved only through differences in output layer weights; and gradient layer constraints, where the parameter update magnitudes of different probability sites are balanced based on the first and second derivatives during the backpropagation stage.

[0026] Regarding model building: The obtained multi-source heterogeneous signaling set is divided into a training set, a validation set, and a test set; the model is trained based on the training set, and training is stopped when any of the following conditions are met: the number of training rounds reaches the upper limit, the loss of the validation set is continuous and stable, or the inversion rate is lower than the threshold; the model performance is verified using test set data;

[0027] Real-time source tracing and determination: Based on the established hotlinking source tracing model, source tracing and determination are performed on multi-source signaling data of live streams.

[0028] The present invention provides a real-time source tracing system for live stream hotlinking based on multi-source heterogeneous signaling fusion, including a multi-source heterogeneous signaling acquisition module, a multi-source heterogeneous signaling feature extraction module, a hotlinking adaptation loss function construction module, a hotlinking source tracing model design module, a parameter dynamic optimization module, and a live stream hotlinking real-time source tracing judgment module.

[0029] The multi-source heterogeneous signaling acquisition module acquires historical multi-signaling mode data and performs preprocessing to obtain a multi-source heterogeneous signaling set;

[0030] The multi-source heterogeneous signaling feature extraction module extracts features from the multi-source heterogeneous signaling set and performs weighted fusion.

[0031] The hotlinking adaptation loss function construction module calculates the prediction error based on the fusion features, defines the hotlinking adaptation loss function, and superimposes the risk probability site inversion penalty term to obtain the total loss function.

[0032] The hotlinking tracing model design module is based on a multi-source heterogeneous signaling set and a total loss function, and designs a hotlinking tracing model with self-attention feature enhancement and multi-probability site parallel prediction.

[0033] The parameter dynamic optimization module dynamically adjusts the single-step parameter update magnitude based on the risk probability site inversion rate to optimize the model parameters.

[0034] The live stream hotlinking real-time tracing and judgment module restricts and controls the risk level in reverse order, establishes a hotlinking tracing model, and performs real-time hotlinking tracing and judgment of live stream hotlinking.

[0035] The beneficial effects achieved by the present invention using the above solution are as follows:

[0036] (1) In view of the fact that general live stream hotlinking real-time tracing methods are difficult to cope with the noise fluctuations of multiple signaling data in live streams, and that high-value signaling information is easily masked by noise, resulting in poor reliability of hotlinking tracing results, this solution constructs a hotlinking adaptation loss function based on the arc-tangent power-law fallback characteristic to adapt to the noise fluctuations of multiple signaling modes to ensure optimization stability; calculates the signaling adaptation coefficient based on the signal-to-noise ratio of each mode to distinguish the value of modal information and balance the error contribution; embeds a risk probability site reverse order penalty term to constrain the monotonicity of risk level, effectively improving the reliability of live stream hotlinking real-time tracing.

[0037] (2) In response to the problem that general live stream hotlinking real-time tracing methods are poorly adaptable to live stream data fluctuations and prone to logical conflicts, which exacerbate the risk of inversion at probability points and lead to poor tracing results, this solution constructs a full-process prevention and control system: designing a parameter dynamic optimization strategy driven by inversion rate to dynamically adapt to data fluctuations and take into account both convergence efficiency and training stability; establishing a structure-gradient dual-dimensional inversion control mechanism to avoid inversion risks throughout the entire chain from model structure design to parameter gradient optimization, significantly improving the hotlinking tracing effect. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion provided by the present invention.

[0039] Figure 2 This is a schematic diagram of a real-time source tracing system for live stream hotlinking based on multi-source heterogeneous signaling fusion provided by the present invention.

[0040] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0041] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0042] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0043] Example 1, see Figure 1 The present invention provides a real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion, the method comprising the following steps:

[0044] Step S1: Multi-source heterogeneous signaling acquisition, obtain historical multi-signaling mode data, and preprocess it to obtain a multi-source heterogeneous signaling set;

[0045] Step S2: Feature extraction of multi-source heterogeneous signaling, feature extraction and weighted fusion of the multi-source heterogeneous signaling set;

[0046] Step S3: Construct the hotlinking adaptation loss function, calculate the prediction error based on the fusion features, define the hotlinking adaptation loss function, and superimpose the risk probability site inversion penalty term to obtain the total loss function;

[0047] Step S4: Design of the hotlinking tracing model. Based on the multi-source heterogeneous signaling set and the total loss function, a hotlinking tracing model with self-attention feature enhancement and multi-probability site parallel prediction is designed.

[0048] Step S5: Dynamic parameter optimization. Based on the risk probability site inversion rate, the single-step parameter update magnitude is dynamically adjusted to optimize the model parameters.

[0049] Step S6: Real-time source tracing and judgment of live stream hotlinking, constraint and control risk level in reverse order, establish hotlinking source tracing model, and perform real-time source tracing and judgment of live stream hotlinking.

[0050] Example 2, see Figure 1This embodiment is based on the above embodiment. In step S1, multi-source heterogeneous signaling acquisition involves obtaining historical multi-source heterogeneous signaling data, including stream signaling modal data, device fingerprint signaling modal data, and network behavior signaling modal data. The stream signaling modal data includes push / pull request signaling from the live streaming server, session ID, timestamp, stream address, and text-based signaling data. The device fingerprint signaling modal data includes the IP address, UA header, hardware model, and numerical feature data of the terminal device. The network behavior signaling modal data includes the size of data packets transmitted over the network, transmission rate, request frequency, and TCP connection duration. The process involves processing long, time-series image data, transforming its temporal features into a two-dimensional heatmap; performing spatiotemporal logical alignment and missing value processing on multi-source data, while simultaneously labeling it with tags including normal streaming and hotlinking streaming; the spatiotemporal logical alignment of multi-source data is achieved by using session ID + timestamp as dual keywords to realize a one-to-one correspondence between three types of data: flow signaling, device fingerprint, and network behavior; the missing value processing involves using bilinear interpolation to fill in missing pixels in the time-series heatmap for image data, filling in empty strings and deleting invalid garbled signaling for text data, and using the mean to fill in missing device feature values ​​for numerical data; resulting in a multi-source heterogeneous signaling set.

[0051] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S2, the multi-source heterogeneous signaling feature extraction is designed based on the characteristics of the three types of heterogeneous signaling data in the multi-source heterogeneous signaling set. A dedicated feature encoder is designed to extract deep features and then map them to a unified feature space through weighted fusion. This strengthens the key features related to hotlinking behavior and weakens redundant interference features. Specifically, it includes:

[0052] For single-source signaling feature extraction, convolutional neural networks are used to extract deep visual features from network behavior signaling modal data to capture abnormal patterns in network transmission. The features are represented as follows: For streaming signaling modes, a Transformer encoder is used to extract semantic features and identify abnormal signaling fields. The features are represented as follows: For device fingerprint signaling modes, standardization is first used to eliminate dimensional differences, and then a fully connected layer is used to extract quantized features to capture abnormal device fingerprints. The features are represented as follows: ;

[0053] in, , and These are network behavior deep feature vectors, flow signaling semantic feature vectors, and device fingerprint quantization feature vectors; It is the feature extraction operation of a convolutional neural network; , and These are time-series heatmap data, flow signaling text data, and device fingerprint numerical data; This is the semantic feature extraction operation of the Transformer encoder; It is a non-linear activation function, using Sigmoid; It is a standardized operation; It is the bias vector of the fully connected layer in the numerical signaling mode;

[0054] Weighted fusion of multi-source signaling features maps heterogeneous features to a unified feature space, achieving weighted fusion of multi-source signaling features, as shown below: ;in, It is a multi-source signaling fusion feature vector; , and is the fusion weight matrix of the three signaling modes; b is the fusion bias vector.

[0055] Example 4, see Figure 1 This embodiment is based on the above embodiment. In step S3, the construction of the hotlinking adaptation loss function transforms the hotlinking tracing of live streams into a hotlinking risk probability quantile prediction task, outputting hotlinking risk values ​​at different confidence levels. To avoid loss non-differentiability and gradient abrupt changes, a hotlinking adaptation loss function is designed, introducing a signaling adaptation coefficient to balance the contribution of different signaling modal errors, and embedding a risk level inversion penalty term to achieve the integration of loss optimization and risk level rationality. Specifically, it includes:

[0056] The hotlinking risk prediction error is defined as the error between the hotlinking risk value predicted by the multi-source signaling fusion feature calculation model and the actual label, expressed as: Where y is the real label of hotlinking behavior, 1 indicates hotlinking, and 0 indicates normal behavior; This is the hotlinking risk prediction value based on the fused features of the model; u is the prediction error;

[0057] The hotlinking adaptation loss function is defined by utilizing the exponential decreasing property of the arc tangent formula and combining it with the signaling adaptation coefficients to construct a globally differentiable hotlinking adaptation loss function. The hotlinking adaptation loss function is expressed as: ;in, It is the hotlinking adaptation loss function; is the probability quantile of the target risk; s is a softening parameter, ranging from 0.05 to 1.0, with a larger value for higher noise levels in hotlinking behavior; It is the signaling adaptation coefficient, calculated from the signal-to-noise ratio of each mode, and expressed as: , , and These are the adaptation coefficients for the three signaling modes;

[0058] The risk level inversion penalty term is designed such that the hotlinking risk levels must satisfy monotonicity (high confidence risk value ≥ low confidence risk value). The inversion penalty term is embedded in the total loss function to measure the degree of monotonicity violation, expressed as: ;in, It is the inversion penalty value of the i-th sample. If a reverse order occurs, a positive penalty value is generated; the greater the degree of reverse order, the higher the penalty value. M is the number of risk probability sites, and m is the index of the risk probability site. and These are the predicted values ​​of the m-th and (m+1)-th risk probability sites of the i-th sample, respectively.

[0059] The total loss function is constructed by integrating hotlinking adaptation loss and reverse order penalty term. , is represented as: Where N is the number of samples in the current training batch; It is the regularization strength coefficient, calculated based on the weighted average of signaling feature dimensions. ;in, This is the base penalty intensity, ranging from 0.1 to 1.0; and These are the feature dimension ratio and feature vector dimension of the f-th type of signaling, respectively.

[0060] By performing the above operations, this solution addresses the problem that general live stream hotlinking real-time tracing methods struggle to handle noise fluctuations in multi-signaling data within live streams, and that high-value signaling information is easily masked by noise, leading to poor reliability of hotlinking tracing results. Instead, this solution constructs a hotlinking adaptation loss function based on the arc-tangent power-law fallback characteristic to adapt to multi-signaling modal noise fluctuations and ensure optimization stability. It calculates signaling adaptation coefficients based on the signal-to-noise ratio of each modality, distinguishes the value of modal information, and balances error contributions. Furthermore, it embeds a risk probability point inversion penalty term to constrain the monotonicity of risk levels, effectively improving the reliability of real-time live stream hotlinking tracing.

[0061] Example 5, see Figure 1 This embodiment is based on the above embodiment. In step S4, the hotlinking tracing model design is based on multi-source heterogeneous signaling feature extraction and total loss function. It constructs a hotlinking tracing model with self-attention feature enhancement and multi-probability site parallel prediction, strengthens the key information of hotlinking behavior in the fused features, and dynamically adjusts the parameter update amplitude based on the hotlinking risk inversion rate to ensure the stability and real-time performance of the model training. Specifically, it includes:

[0062] The feature enhancement unit design incorporates a self-attention mechanism to automatically filter key information strongly correlated with hotlinking behavior from the fused features, while weakening redundant information. The feature enhancement formula is expressed as: ;in, It is the enhanced hotlinking feature vector; It is a self-attention feature enhancement operation; , and These are the query, key, and value matrices of the attention mechanism, respectively. Obtained by linear transformation; It is the dimension of the key matrix, used for scaling the attention score;

[0063] A multi-probability site parallel prediction unit design is implemented, which constructs a deep fully connected network based on enhanced features to achieve parallel output of multi-confidence hotlinking risk values. The model prediction formula is expressed as follows: ;in, and These are the weight matrix and bias vector of the hidden layer, respectively; and These are the weight matrix and bias vector of the output layer, and the dimension of the output layer is equal to the number of target risk probability sites. It is the ReLU activation function.

[0064] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S5, the dynamic parameter optimization is to avoid the reverse order of the risk probability site prediction results. By monitoring the reverse order rate of risk probability sites in real time, the single-step parameter update magnitude of the model is dynamically adjusted. The specific operation is as follows:

[0065] During training, the inversion rate (CR) of risk probability sites is calculated in real time to quantify the rationality of the risk level prediction, and is expressed as: When CR>0.1, it indicates a severe inversion of risk probability sites. Dynamically reduce the single-step parameter update amplitude (reducing it by 0.1 times each time) to suppress the prediction chaos caused by excessive parameter update amplitude. Otherwise, it indicates that the prediction result is reasonable. Appropriately increase the single-step parameter update amplitude (increasing it by 0.02 times each time) to improve the model convergence speed. It is an indicator function; its value is 1 when the condition in parentheses is true, and 0 otherwise. The parameters involved include model structure hyperparameters, training hyperparameters, and loss function hyperparameters. The optimizer selected is the Adam optimizer. The parameter update process is as follows: Adam optimizer iterative update - calculate the inversion rate - dynamically adjust the single-step update amplitude - fine-tune the update amplitude of each point according to the gradient layer constraints during backpropagation - enter the next iteration.

[0066] Example 7, see Figure 1 This embodiment is based on the above embodiment. In step S6, the real-time source tracing of live stream hotlinking actively controls the risk level inversion from two dimensions: model structure and gradient optimization. Combined with the trained model, it realizes real-time source tracing of live stream hotlinking and outputs the hotlinking risk probability range and source tracing results. The specific operation is as follows:

[0067] Two-dimensional proactive control of inversion includes: structural layer constraints, where all risk probability sites share the same set of feature enhancement and fully connected network parameters, and prediction of different sites is achieved only through differences in output layer weights, avoiding inversion caused by different feature selection logic; and gradient layer constraints, where the parameter update magnitudes of different probability sites are balanced based on the first and second derivatives during the backpropagation stage, and the parameter update magnitudes are expressed as: ;in, It is the update magnitude of the predicted value for the m-th risk probability point; and These are the first and second derivatives of the i-th sample at the m-th risk probability site, respectively; to avoid the situation where the update magnitude of low-risk probability sites exceeds that of high-risk probability sites; It is the learning rate, with a value of 1e. -5 ~0.1; It is a smoothing coefficient, with a value ranging from 0.01 to 0.1;

[0068] Regarding model building: The obtained multi-source heterogeneous signaling set is divided into a training set, a validation set, and a test set; the model is trained based on the training set, and training stops when any of the following conditions are met: the number of training rounds reaches the upper limit (50~200), the validation set loss is continuous and stable, or the inversion rate is lower than the threshold (0.03~0.05); the model performance is verified using the test set data, requiring that the source tracing accuracy corresponding to the quantile loss is not less than 0.97;

[0069] Real-time source tracing and determination are performed on multi-source signaling data of live streams based on the established hotlinking source tracing model. The process is as follows: new multi-source signaling data of live streams are input, and then processed sequentially through single signaling modality feature extraction, multi-source feature weighted fusion, self-attention feature enhancement, and parallel prediction of multiple probability sites. Hotlinking risk values ​​of M probability sites are output to form hotlinking risk probability intervals. When the risk value of a high-confidence site (τ=0.9) is ≥0.8, it is determined to be hotlinking behavior, and the corresponding source tracing information including device fingerprint and stream address is output.

[0070] By performing the above operations, this solution addresses the problems of poor adaptability to live stream data fluctuations, logical conflicts, and increased risk of inversion at probabilistic points, leading to poor tracing results, which are common in real-time tracing methods for live stream hotlinking. It constructs a comprehensive prevention and control system: a parameter dynamic optimization strategy driven by inversion rate is designed to dynamically adapt to data fluctuations, balancing convergence efficiency and training stability; a structure-gradient dual-dimensional inversion control mechanism is established to avoid inversion risks throughout the entire process from model structure design to parameter gradient optimization, significantly improving the effectiveness of hotlinking tracing.

[0071] Example 8, see Figure 2Based on the above embodiments, the real-time source tracing system for live stream hotlinking based on multi-source heterogeneous signaling fusion provided by the present invention includes a multi-source heterogeneous signaling acquisition module, a multi-source heterogeneous signaling feature extraction module, a hotlinking adaptation loss function construction module, a hotlinking source tracing model design module, a parameter dynamic optimization module, and a live stream hotlinking real-time source tracing judgment module.

[0072] The multi-source heterogeneous signaling acquisition module acquires historical multi-signaling mode data and performs preprocessing to obtain a multi-source heterogeneous signaling set;

[0073] The multi-source heterogeneous signaling feature extraction module extracts features from the multi-source heterogeneous signaling set and performs weighted fusion.

[0074] The hotlinking adaptation loss function construction module calculates the prediction error based on the fusion features, defines the hotlinking adaptation loss function, and superimposes the risk probability site inversion penalty term to obtain the total loss function.

[0075] The hotlinking tracing model design module is based on a multi-source heterogeneous signaling set and a total loss function, and designs a hotlinking tracing model with self-attention feature enhancement and multi-probability site parallel prediction.

[0076] The parameter dynamic optimization module dynamically adjusts the single-step parameter update magnitude based on the risk probability site inversion rate to optimize the model parameters.

[0077] The live stream hotlinking real-time tracing and judgment module restricts and controls the risk level in reverse order, establishes a hotlinking tracing model, and performs real-time hotlinking tracing and judgment of live stream hotlinking.

[0078] It should be noted that, in this document, the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0079] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

[0080] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion, characterized in that: The method includes the following steps: Step S1: Multi-source heterogeneous signaling acquisition, obtain historical multi-signaling mode data, and preprocess it to obtain a multi-source heterogeneous signaling set; Step S2: Feature extraction of multi-source heterogeneous signaling, feature extraction and weighted fusion of the multi-source heterogeneous signaling set; Step S3: Construct the hotlinking adaptation loss function, calculate the prediction error based on the fusion features, define the hotlinking adaptation loss function, and superimpose the risk probability site inversion penalty term to obtain the total loss function; Step S4: Design of the hotlinking tracing model. Based on the multi-source heterogeneous signaling set and the total loss function, a hotlinking tracing model with self-attention feature enhancement and multi-probability site parallel prediction is designed. Step S5: Dynamic parameter optimization. Based on the risk probability site inversion rate, the single-step parameter update magnitude is dynamically adjusted to optimize the model parameters. Step S6: Real-time source tracing and judgment of live stream hotlinking, constraint and control risk level in reverse order, establish hotlinking source tracing model, and perform real-time source tracing and judgment of live stream hotlinking; In step S2, the multi-source heterogeneous signaling feature extraction includes: Weighted fusion of multi-source signaling features maps heterogeneous features to a unified feature space, achieving weighted fusion of multi-source signaling features, as shown below: ;in, It is a multi-source signaling fusion feature vector; , and is the fusion weight matrix for the three signaling modes; b is the fusion bias vector; , and These are network behavior deep feature vectors, flow signaling semantic feature vectors, and device fingerprint quantization feature vectors; In step S3, the construction of the hotlinking adaptation loss function specifically includes: The hotlinking risk prediction error is defined as the error between the hotlinking risk value predicted by the multi-source signaling fusion feature calculation model and the actual label, expressed as: Where y is the real label of hotlinking behavior, 1 indicates hotlinking, and 0 indicates normal behavior; This is the hotlinking risk prediction value based on the fused features of the model; u is the prediction error; The hotlinking adaptation loss function is defined by utilizing the exponential decreasing property of the arc tangent formula and combining it with the signaling adaptation coefficients to construct a globally differentiable hotlinking adaptation loss function. The hotlinking adaptation loss function is expressed as: ;in, It is the hotlinking adaptation loss function; It is the target risk probability quantile; s is the softening parameter; It is the signaling adaptation coefficient; The risk level inversion penalty term is designed by embedding the inversion penalty term into the total loss function, expressed as: ;in, is the inversion penalty value for the i-th sample; M is the number of risk probability sites, and m is the risk probability site index; and These are the predicted values ​​of the m-th and (m+1)-th risk probability sites of the i-th sample, respectively. The total loss function is constructed by integrating hotlinking adaptation loss and reverse order penalty term. , represented as: Where N is the number of samples in the current training batch; It is the regularization strength coefficient, calculated based on the weighted average of signaling feature dimensions. ;in, This is the base penalty intensity; and These are the feature dimension ratio and feature vector dimension of the f-th type of signaling, respectively. In step S4, the design of the hotlinking tracing model specifically includes: The feature enhancement unit design incorporates a self-attention mechanism to automatically filter key information strongly correlated with hotlinking behavior from the fused features. The feature enhancement formula is expressed as: ;in, It is the enhanced hotlinking feature vector; It is a self-attention feature enhancement operation; , and These are the query, key, and value matrices for the attention mechanism; It is the dimension of the key matrix, used for scaling the attention score; A multi-probability site parallel prediction unit design is implemented, which constructs a deep fully connected network based on enhanced features to achieve parallel output of multi-confidence hotlinking risk values. The model prediction formula is expressed as follows: ;in, and These are the weight matrix and bias vector of the hidden layer, respectively; and The weight matrix and bias vector of the output layer; It is the ReLU activation function.

2. The real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion according to claim 1, characterized in that: In step S5, the dynamic optimization of parameters involves calculating the inversion rate of risk probability sites in real time during training and adjusting the single-step parameter update magnitude.

3. The real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion according to claim 2, characterized in that: In step S6, the real-time source tracing determination of live stream hotlinking specifically includes: Two-dimensional reverse-order active control includes: structural layer constraints, where all risk probability sites share the same set of feature enhancement and fully connected network parameters, and different site predictions are achieved only through differences in output layer weights; and gradient layer constraints, where the parameter update magnitudes of different probability sites are balanced based on the first and second derivatives during the backpropagation stage. Regarding model building: The obtained multi-source heterogeneous signaling set is divided into a training set, a validation set, and a test set; the model is trained based on the training set, and training is stopped when any of the following conditions are met: the number of training rounds reaches the upper limit, the loss of the validation set is continuous and stable, or the inversion rate is lower than the threshold; the model performance is verified using test set data; Real-time source tracing and determination: Based on the established hotlinking source tracing model, source tracing and determination are performed on multi-source signaling data of live streams.

4. The real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion according to claim 3, characterized in that: In step S1, the multi-source heterogeneous signaling acquisition involves obtaining historical multi-source heterogeneous signaling data, including flow signaling modal data, device fingerprint signaling modal data, and network behavior signaling modal data; performing spatiotemporal logical alignment and missing value processing on the multi-source data; and simultaneously labeling the data. A multi-source heterogeneous signaling set is obtained.

5. The real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion according to claim 4, characterized in that: In step S2, the multi-source heterogeneous signaling feature extraction further includes: For single-source signaling feature extraction, convolutional neural networks are used to extract deep visual features for network behavior signaling modal data to capture abnormal patterns in network transmission; for flow signaling modal data, a Transformer encoder is used to extract semantic features to identify abnormal signaling fields; for device fingerprint signaling modal data, standardization is first used to eliminate dimensional differences, and then a fully connected layer is used to extract quantized features to capture abnormal device fingerprints.

6. A real-time source tracing system for live stream hotlinking based on multi-source heterogeneous signaling fusion, used to implement the real-time source tracing method for live stream hotlinking based on multi-source heterogeneous signaling fusion as described in any one of claims 1-5, characterized in that: It includes a multi-source heterogeneous signaling acquisition module, a multi-source heterogeneous signaling feature extraction module, a hotlinking adaptation loss function construction module, a hotlinking tracing model design module, a parameter dynamic optimization module, and a live stream hotlinking real-time tracing and judgment module. The multi-source heterogeneous signaling acquisition module acquires historical multi-signaling mode data and performs preprocessing to obtain a multi-source heterogeneous signaling set; The multi-source heterogeneous signaling feature extraction module extracts features from the multi-source heterogeneous signaling set and performs weighted fusion. The hotlinking adaptation loss function construction module calculates the prediction error based on the fusion features, defines the hotlinking adaptation loss function, and superimposes the risk probability site inversion penalty term to obtain the total loss function. The hotlinking tracing model design module is based on a multi-source heterogeneous signaling set and a total loss function, and designs a hotlinking tracing model with self-attention feature enhancement and multi-probability site parallel prediction. The parameter dynamic optimization module dynamically adjusts the single-step parameter update magnitude based on the risk probability site inversion rate to optimize the model parameters. The live stream hotlinking real-time tracing and judgment module restricts and controls the risk level in reverse order, establishes a hotlinking tracing model, and performs real-time hotlinking tracing and judgment of live stream hotlinking.

Images