Risk link identification methods, devices, electronic equipment, media and program products

Abstract

This application discloses a risk link identification method, apparatus, electronic device, medium, and program product, relating to the field of data processing technology. The risk link identification method includes: receiving a target link and industry information of the target industry to which the target link belongs; acquiring multi-dimensional features of the link page indicated by the target link, and determining the risk value of each dimension feature based on the violation feature library of the target industry; determining the initial risk value of the target link based on the risk value of each dimension feature; normalizing the initial risk value based on the risk normalization factor of the target industry to obtain the standard risk value of the target link; and determining whether the target link is a risk link based on the standard risk value of the target link and the risk threshold of the target industry.

Description

Technical Field

[0001] This application relates to the field of data processing technology, specifically to a risk link identification method, apparatus, electronic device, medium, and program product. Background Technology

[0002] With the rapid development of the digital economy, links (such as advertising links) serve as the core carriers of information dissemination and business transformation. Their security and compliance are directly related to the stability of the digital economy and the protection of users' rights. Therefore, the identification of risky links is crucial for the healthy development of the digital economy.

[0003] In related technologies, methods for identifying whether a link is a risky link mainly rely on whether the linked page contains risky characteristics, such as identifying whether the text on the linked page contains prohibited words or whether the images on the linked page contain prohibited images. However, the risk characteristics of different industries vary significantly. Using homogeneous identification methods, such as using the same prohibited words or images, can easily lead to low accuracy in identifying risky links when identifying links belonging to different industries, making it difficult to meet the requirements of link security and compliance in the digital economy. Summary of the Invention

[0004] This application provides a risk link identification method, apparatus, electronic device, medium, and program product. By closely coupling the identification process of whether a target link is a risk link with the target industry to which the target link belongs, differentiated identification of links belonging to different industries is achieved, thereby improving the identification accuracy of risk links.

[0005] In a first aspect, embodiments of this application provide a method for identifying risky links, the method comprising: Receive the target link and industry information of the target industry to which the target link belongs; Obtain multi-dimensional features of the linked page indicated by the target link, and determine the risk value of each dimension feature based on the violation feature library of the target industry; the multi-dimensional features include at least the text features, image features and behavioral features of the linked page; the violation features in the violation feature library of different industries are different; Based on the risk values ​​of each dimension of characteristics, the initial risk value of the target link is determined; Based on the risk normalization factor of the target industry, the initial risk value is normalized to obtain the standard risk value of the target link; the risk normalization factor is used to indicate the historical risk value distribution of the target industry link; Based on the standard risk value of the target link and the risk threshold of the target industry, determine whether the target link is a risky link.

[0006] In some embodiments, multi-dimensional features of the linked page indicated by the target link are obtained, and risk values ​​of each dimension of the multi-dimensional features are determined based on a violation feature library of the target industry, including: Get at least one word segment from the text content of the linked page, determine the semantic similarity between the word segment and the illegal words in the violation feature library, and determine the text feature risk value based on the semantic similarity and the industry basic risk value of each illegal word. Obtain the global image and at least one sub-image from the image content of the linked page, determine the scaling dot product score of each sub-image relative to the global image, and determine the image feature risk value based on the scaling dot product score, violation confidence, and industry matching degree of each sub-image; wherein, the violation confidence is used to indicate whether the sub-image contains a violation image from the violation feature library; the industry matching degree is used to indicate the degree of matching between the violation image contained in the sub-image and the target industry; The system acquires interactive behaviors generated during the access to linked pages and determines the behavioral characteristic risk value based on preset behavioral characteristic risk rules.

[0007] In some embodiments, obtaining at least one word segment from the text content of the linked page and determining the semantic similarity between the word segment and violating words in the violation feature library includes: Extract the text content from the linked page, perform word segmentation on the text content, and obtain at least one word; Obtain the violation term library from the violation feature library of the target industry; each violation term in the violation term library is associated with a corresponding violation term vector and the basic risk value of the industry; Determine the context correction coefficient of each word segment relative to each violating word in the violation lexicon; Based on the word vectors corresponding to each word segment, the word vectors corresponding to each violating word, and the context correction coefficient, the semantic similarity between each word segment and each violating word is determined.

[0008] In some embodiments, text feature risk values ​​are determined based on semantic similarity and the industry-based risk values ​​of each violating word, including: Based on the semantic similarity between each word segment and each violating word, and the industry-based basic risk value of the corresponding violating word, the risk contribution value of each word segment is determined; The text feature risk value is determined based on the risk contribution value of each word segment and the word frequency weight of each violating word; whereby the word frequency weight is used to indicate the number of times the corresponding violating word appears in the text content.

[0009] In some embodiments, obtaining a global image and at least one sub-image from the image content of a linked page, and determining the scaled dot product score of each sub-image relative to the global image, includes: Extract the image content from the linked page, and obtain the global image and at least one sub-image from the image content; Extract the query vector corresponding to the global image and the key vector corresponding to each sub-image; the query vector and the key vector have the same vector dimension. For each sub-image, the scaling dot product score of each sub-image relative to the global image is determined based on the key vector, query vector, and vector dimension of the sub-image.

[0010] In some embodiments, image feature risk values ​​are determined based on the scaled dot product score, violation confidence, and industry matching degree of each sub-image, including: Obtain the violation image library from the violation feature library; each violation image in the violation image library is associated with a corresponding industry matching degree; Based on the illegal images in the illegal image library, determine the illegality confidence of each sub-image and the corresponding industry matching degree; Based on the scaled dot product score, violation confidence, and industry matching degree of each sub-image, the normalized association weight of each sub-image relative to the global image is determined. Based on the normalized association weights, violation confidence, and industry matching degree of each sub-image, the risk feature values ​​of the images are determined.

[0011] In some embodiments, the interactive behavior includes the number of QR codes within the linked page and the redirection behavior of the linked page; Acquire interactive behaviors generated during the access to linked pages, and determine behavioral characteristic risk values ​​based on preset behavioral characteristic risk rules, including: Get the number of redirects that occurred during the access to the linked page; and / or, identify the number of QR codes contained in the linked page; Based on the number and / or quantity of redirections, and the QR code quantity weight and redirection behavior weight configured according to the preset behavioral characteristic risk rules, the behavioral characteristic risk value is determined.

[0012] In some embodiments, the initial risk value of the target link is determined based on the risk values ​​of each dimension of characteristics, including: Obtain historical link violation data for the target industry; Based on the number of text content violation cases, image content violation cases, and behavioral violation cases in historical link violation data, the dimensional feature weights of each dimension are determined. The initial risk value of the target link is determined based on the risk value of each dimension feature and the dimensional feature weight of each dimension feature.

[0013] In some embodiments, the dimensional feature weights of each dimension are determined based on the number of text content violation cases, image content violation cases, and behavioral violation cases in historical link violation data, including: Based on the number of text content violation cases, image content violation cases, and behavioral violation cases in historical link violation data, the number of text content violation cases, image content violation cases, and behavioral violation cases are normalized respectively to obtain the normalized values ​​corresponding to the number of text content violation cases, image content violation cases, and behavioral violation cases. Determine the normalized values ​​corresponding to the number of text content violation cases, the number of image content violation cases, and the number of behavioral violation cases, respectively, which are the text feature weights, image feature weights, and behavioral feature weights.

[0014] In some embodiments, the initial risk value is normalized based on the risk normalization factor of the target industry to obtain the standard risk value of the target link, including: Obtain the historical risk value distribution of the target industry; Determine the preset quantile value in the historical risk value distribution as the risk normalization factor for the target industry; Based on the risk normalization factor, the initial risk value is normalized to obtain the normalized initial risk value; The smaller of the normalized initial risk value and the preset risk threshold is determined as the standard risk value for the target link.

[0015] In some embodiments, determining whether a target link is a risky link based on a standard risk value for the target link and a risk threshold for the target industry includes: Determine whether the standard risk value is greater than the risk threshold; If the judgment result is yes, the target link is determined to be a suspicious and risky link; A review prompt was issued for the target link; In response to a successful review prompt, the target link is determined to be a safe link; or, in response to a failed review prompt, the target link is determined to be a risky link.

[0016] In some embodiments, the method provided in the first aspect is applied to an Identity as a Service (IDaaS) server; Receive the target link and industry information of the target industry to which the target link belongs, including: Receive delivery requests from tenants; the delivery request must include at least the target industry of the entity to which the link to be delivered belongs, and the qualification information of the entity to which the link is delivered; Based on the qualification information of the link placement entity and the list of non-compliant institutions in the non-compliance feature database of the target industry, determine whether the qualification of the link placement entity is compliant. If the entity that placed the link is qualified, generate and send the entity's link identifier to the tenant. Receive link reporting requests from tenants. The link reporting request must include at least the identifier of the link delivery entity and the target link.

[0017] Secondly, embodiments of this application provide a risk link identification device, the device comprising: The link receiving module is used to receive target links and industry information of the target industry to which the target link belongs; The dimensional feature risk value determination module is used to obtain multi-dimensional features of the linked page indicated by the target link, and determine the risk value of each dimension feature based on the violation feature library of the target industry; the multi-dimensional features include at least the text features, image features and behavioral features of the linked page; the violation features in the violation feature library of different industries are different; The initial risk value determination module is used to determine the initial risk value of the target link based on the risk values ​​of features in each dimension. The standard risk value determination module is used to normalize the initial risk value based on the risk normalization factor of the target industry to obtain the standard risk value of the target link; the risk normalization factor is used to indicate the historical risk value distribution of the target industry link; The link identification module is used to determine whether a target link is a risky link based on the target link's standard risk value and the target industry's risk threshold.

[0018] Thirdly, embodiments of this application provide an electronic device, including: a processor and a memory for storing a computer program capable of running on the processor, wherein, when the processor runs the computer program, it performs the method described in any embodiment of the first aspect.

[0019] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform the methods described in any embodiment of the first aspect.

[0020] Fifthly, embodiments of this application provide a computer program product including computer-executable instructions that, when executed by a processor, implement the method described in any embodiment of the first aspect.

[0021] The risk link identification method provided in this application first extracts multi-dimensional features (text, image, and behavioral features) and calculates risk values ​​for the linked page based on the target industry to which the target link belongs, using the corresponding violation feature library. Then, it dynamically determines the risk normalization factor based on the historical risk value distribution of links in the target industry, and performs industry-adaptive normalization processing on the initial risk value after multi-dimensional feature fusion to obtain the standard risk value of the target link. Finally, it determines whether the target link is a risk link based on the risk threshold adapted to the target industry. In this process, the determination of whether a target link is a risk link is highly coupled with the industry to which the target link belongs, thus effectively solving the problem of low accuracy in identifying links belonging to different industries in homogeneous risk link identification methods in related technologies.

[0022] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are merely embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort, and this application can be applied to other similar scenarios based on the provided drawings.

[0024] Figure 1 A flowchart illustrating a risk link identification method provided in an embodiment of this application; Figure 2 A flowchart illustrating the method for determining text feature risk values ​​provided in this application embodiment; Figure 3 A flowchart illustrating the method for determining image feature risk values ​​provided in an embodiment of this application; Figure 4 A flowchart illustrating the method for determining the risk value of behavioral characteristics provided in this application embodiment; Figure 5 A flowchart illustrating the method for determining an initial risk value provided in an embodiment of this application; Figure 6 A flowchart illustrating the method for determining a standard risk value provided in an embodiment of this application; Figure 7 A flowchart illustrating the method for determining whether a target link is a risky link, as provided in an embodiment of this application; Figure 8 A flowchart illustrating the method for receiving a target link provided in an embodiment of this application; Figure 9A flowchart illustrating a risk link identification method provided as an example in this application; Figure 10 This is a schematic diagram of the structure of a risk link identification device provided in an embodiment of this application; Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. The described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0026] It should be noted that the terms "system," "device," "unit," and / or "module" used in this application are methods of distinguishing different components, elements, parts, sections, or assemblies at different levels. However, if other terms can achieve the same purpose, they can be replaced by other expressions.

[0027] Hereinafter, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first," "second," or "third" may explicitly or implicitly include one or more of that feature.

[0028] With the rapid development of the digital economy, links (such as advertising links) serve as the core carriers of information dissemination and business transformation. Their security and compliance are directly related to the stability of the digital economy and the protection of users' rights. Therefore, the identification of risky links is crucial for the development of the digital economy.

[0029] In related technologies, methods for identifying whether a link is a risky link mainly rely on whether the linked page contains risky characteristics. For example, taking a method and system for reviewing online advertising provided by related technologies as an example, the review method includes: The process involves acquiring advertising information, including Uniform Resource Locator (URL) links, text, and images; identifying the number of QR code images within the images; extracting the text content from the destination address of the URL link using web crawlers; calculating the risk value of the text (including text and content) and the risk value of the images; and then calculating the overall risk value of the advertisement. This review method can calculate the risk value of an advertisement based on its information. However, for different industries, the same calculation method is used for risk identification of text and images. Specifically, different industries use the same prohibited keywords, and the prohibited images are all QR code images. However, the risk characteristics of different industries vary significantly. Using the same prohibited keywords or the same prohibited images in a homogenized identification method can easily lead to low accuracy in identifying risky links when identifying links belonging to different industries.

[0030] To address the aforementioned issues, embodiments of this application provide a risky link identification method, apparatus, electronic device, medium, and program product. By tightly coupling the identification process of whether a target link is a risky link with the target industry to which the target link belongs, differentiated identification of links belonging to different industries is achieved, thereby improving the accuracy of risky link identification.

[0031] The following section provides a detailed description of a risk assessment method provided in this application, with reference to the accompanying drawings.

[0032] Figure 1 This is a flowchart illustrating a risky link identification method provided in an embodiment of this application. Figure 1 As shown, the risk link identification method includes the following steps: Step 101: Receive the target link and the industry information of the target industry to which the target link belongs; In some embodiments, a target link refers to a link that is to be identified as a risky link. Target links can be advertising links (such as e-commerce product links, financial service links, educational service links, medical service links, etc.), social media platform links, content information platform links, government service links, etc., and are not limited thereto in this application.

[0033] In some embodiments, the target link can be received by the link placement entity through an open application programming interface (API) or by the link placement entity uploading a target link through a preset client or user interface. The link placement entity can be a link operator, including e-commerce platforms, financial service platforms, medical service platforms, social platforms, content information platforms, and other platforms with link placement needs; or it can be a third-party link promotion entity, such as a marketing company or agency that provides advertising link promotion services to merchants.

[0034] In some embodiments, when receiving a target link via API, an authentication mechanism can be pre-set for the API interface to allow only compliant link placement entities to transmit data through the API interface; at the same time, the transmitted target link and industry information are format-validated. If the format does not conform to the preset standard (such as missing industry information or incorrect link format), a verification failure message is returned to the link placement entity, and the link placement entity is required to supplement or correct the information.

[0035] In some embodiments, the target industry to which a target link belongs refers to the core business area of ​​the goods, services, or content corresponding to the target link, which can be determined by the function of the linked page and the type of products and / or services provided. For example, if the goods corresponding to a target link are fresh produce, then the target industry to which the target link belongs is e-commerce - fresh produce; if the service corresponding to a target link is financial services, then the target industry to which the target link belongs is finance - wealth management.

[0036] In some embodiments, the target industry to which the target link belongs may also be selected by the link-issuing entity before transmitting the target link.

[0037] Step 102: Obtain the multi-dimensional features of the linked page indicated by the target link, and determine the risk value of each dimension feature based on the violation feature library of the target industry. In some embodiments, the violation features in the violation feature database differ across industries; for example, for the e-commerce-fresh food industry, the violation feature database includes features such as "number one across the entire network"; for the finance-wealth management industry, the violation feature database includes features such as "annualized rate of return > 8% without risk warning".

[0038] In some embodiments, multi-dimensional features include at least the text features, image features, and behavioral features of the linked page. Multi-dimensional features may also include the domain registration duration and server location of the linked page. For example, domains with short registration durations, or servers located overseas without cross-border service registration, are directly assigned a high-risk value.

[0039] In some embodiments, text recognition models or crawling tools can be used to obtain the HyperText Markup Language (HTML) text of the linked page to obtain the text features of the linked page; image recognition models or image cropping tools can be used to obtain the image features of the linked page, such as the global image and sub-images of the linked page (independent image elements within the linked page, such as the logo of the linking entity, the certification mark of the product); page monitoring tools can be used to obtain the behavioral features of the linked page (such as the number of QR codes, the number of redirects, etc.).

[0040] In some embodiments, features such as text, images, and behaviors can be matched with corresponding types of violations in the violation feature library of the target industry based on similarity. Combined with preset feature violation level weights and matching thresholds, the risk value for each dimension is quantified and output. Alternatively, based on preset feature risk assessment rules in the violation feature library of the target industry, key feature attributes (such as the frequency of violating words in the text, the proportion of violating elements in the image, and the number of behavioral violations) can be extracted, and the risk value for each dimension can be calculated through weighted summation or hierarchical scoring.

[0041] Step 103: Determine the initial risk value of the target link based on the risk values ​​of each dimension of features; In some embodiments, the initial risk value of the target link can be determined by weighted summation based on the risk values ​​of each dimension feature and the dimension features of each dimension feature.

[0042] In some embodiments, the sum of the risk values ​​of each dimension feature can be directly used as the initial risk value of the target link.

[0043] In some embodiments, the maximum or average risk value among the risk values ​​of each dimension feature can be used as the initial risk value of the target link.

[0044] Step 104: Based on the risk normalization factor of the target industry, normalize the initial risk value to obtain the standard risk value of the target link; In some embodiments, the risk normalization factor is used to indicate the distribution of historical risk values ​​of links in the target industry.

[0045] In some embodiments, the historical risk value distribution of the target industry links can be obtained first, such as the historical risk value distribution of the past 3 months (or the past 5 months, etc., which is not limited in this application), and then the average value of the historical risk values ​​of the past 3 months can be determined as the risk normalization factor; or the 95% (or 98%, etc., which is not limited in this application) quantile of the historical risk values ​​of the past 3 months can be used as the risk normalization factor.

[0046] In some embodiments, normalizing the initial risk value refers to normalizing the initial risk value using a normalization formula. The normalization formula is as follows: Standard risk value = Initial risk value / Risk normalization factor.

[0047] Step 105: Based on the standard risk value of the target link and the risk threshold of the target industry, determine whether the target link is a risky link.

[0048] In some embodiments, if the standard risk value is greater than the risk threshold, the target link can be directly identified as a risky link.

[0049] In some embodiments, if the standard risk value is greater than the risk threshold, the target link may first be identified as a suspected risk link. Then, a manual review of the target link will determine whether it is indeed a risk link.

[0050] In summary, the risk link identification method provided in this application firstly extracts multi-dimensional features (text, image, and behavioral features) and calculates risk values ​​for the linked page based on the target industry to which the target link belongs, using the corresponding violation feature library. Then, it dynamically determines the risk normalization factor based on the historical risk value distribution of links in the target industry, performing industry-adaptive normalization on the initial risk value after multi-dimensional feature fusion to obtain the standard risk value of the target link. Finally, it determines whether the target link is a risk link based on the risk threshold adapted to the target industry. In this process, the determination of whether a target link is a risk link is highly coupled with the industry to which the target link belongs, thus effectively solving the problem of low accuracy in identifying links belonging to different industries in related technologies using homogeneous risk link identification methods.

[0051] In one embodiment, step 102 determines the risk value of each dimension feature in the multi-dimensional features, including determining the risk value of text features, determining the risk value of image features, and determining the risk value of behavioral features.

[0052] The determination of text feature risk values ​​includes: Obtain at least one word segment from the text content of the linked page, determine the semantic similarity between the word segment and the violating words in the violation feature library, and determine the text feature risk value based on the semantic similarity and the industry basic risk value of each violating word.

[0053] In some embodiments, word segmentation methods based on dictionary matching (e.g., matching the longest word in the text content from left to right or from right to left based on a preset dictionary), statistical models trained on large-scale corpora, etc., can be used to segment the text content to obtain at least one word in the text content.

[0054] In some embodiments, the semantic similarity can be calculated using the cosine similarity method or the dot product similarity method to calculate the semantic similarity between the word segment and the violating word.

[0055] In some embodiments, a weighted summation method can be used to determine the text feature risk value based on the semantic similarity between the word segment and each violating word, and the industry basic risk value of each violating word; or, a semantic similarity threshold can be set, and only the matching results of violating words with similarity exceeding the threshold can be retained; then the filtered semantic similarity is multiplied by the corresponding industry basic risk value, and the weighted summation is used to obtain the text feature risk value, etc.

[0056] The determination of image feature risk values ​​includes: Obtain the global image and at least one sub-image from the image content of the linked page, determine the scaling dot product score of each sub-image relative to the global image, and determine the image feature risk value based on the scaling dot product score, violation confidence, and industry matching degree of each sub-image.

[0057] In some embodiments, the violation confidence score is used to indicate whether a sub-image contains a violation image from a violation feature library; the industry matching score is used to indicate the degree of matching between the violation image contained in the sub-image and the target industry.

[0058] In some embodiments, the method for determining the scaled dot product score of each sub-image relative to the global image may employ the scaled dot product method, which will not be elaborated here.

[0059] In some embodiments, the normalized association weight of each sub-image relative to the global image can be determined first based on the scaled dot product score, violation confidence, and industry matching degree of each sub-image. Then, the image risk feature value can be determined based on the normalized association weight, violation confidence, and industry matching degree of each sub-image.

[0060] The determination of behavioral characteristic risk values ​​includes: The system acquires interactive behaviors generated during the access to linked pages and determines the behavioral characteristic risk value based on preset behavioral characteristic risk rules.

[0061] In some embodiments, a preset behavioral characteristic risk rule is used to indicate a method for calculating behavioral characteristic risk values ​​based on different interactive behaviors. For example, the behavioral characteristic risk value is calculated using a weighted summation method based on the quantified value of each interactive behavior.

[0062] Figure 2 This is a flowchart illustrating the method for determining the risk value of text features provided in an embodiment of this application.

[0063] In some embodiments, based on the above description of determining the risk value of text features, such as Figure 2As shown, at least one word segment is obtained from the text content of the linked page, the semantic similarity between the word segment and the violating words in the violation feature library is determined, and the text feature risk value is determined based on the semantic similarity and the industry-based risk value of each violating word, including the following steps: Step 201: Extract the text content of the linked page, perform word segmentation on the text content, and obtain at least one word segmentation. In some embodiments, the HTML text (text content) of the linked page can be segmented using a Jieba+ dictionary-based word segmentation method to obtain at least one word from the HTML text. For example, if the target link belongs to the financial industry, the obtained word segmentation could be "non-standard bonds" or "asset management plan," etc.

[0064] Step 202: Obtain the violation keyword database from the violation feature database of the target industry; In some embodiments, each illegal word in the illegal word library is associated with a corresponding illegal word vector and an industry-based basic risk value.

[0065] Step 203: Determine the context correction coefficient of each word segment relative to each violating word in the violating word library; In some embodiments, a deep learning-based semantic understanding model can be used. The sentence to which each word segment belongs and the prohibited words in the prohibited word list are taken as input. The deep learning-based semantic understanding model performs syntactic and semantic analysis on the entire sentence, determining the overall sentiment and logical relationships. Finally, the input word segment is evaluated based on its contextual correction coefficient relative to each prohibited word in the prohibited word list. For example, the correction coefficient for "high returns" in the financial industry's prohibited word list is higher than that in the e-commerce industry.

[0066] In some embodiments, the context correction coefficient can be used C i,,j Indicates, specifically C i,,j Indicates the first i The word segmentation relative to the first j The context correction coefficient for each violating word.

[0067] Step 204: Determine the semantic similarity between each segment and each violating word based on the segmented word vectors, the violating word vectors, and the context correction coefficients.

[0068] In some embodiments, a trained feature extraction model can be used, taking each word segment as input, to obtain the word vector corresponding to each word segment. Alternatively, a trained feature extraction model can be used, taking each violating word as input, to obtain the violating word vector corresponding to each violating word. The word vector corresponding to each word segment can be obtained using... W i Specifically, Wi Indicates the first in the text content i The word vectors of each segmented word; the word vectors of the violating words can be used. P ,j Specifically, P ,j Indicates the first j The vector of each violating word.

[0069] In some embodiments, the first i The word segmentation and the first j The semantic similarity between each violating word is simi( W i , P ,j This can be represented as: .

[0070] In some embodiments, simi( W i , P ,j The larger the value, the more likely it is to be the first. i The word segmentation and the first j The more similar the prohibited words are.

[0071] Step 205: Based on the semantic similarity between each word segment and each violating word, and the industry-based basic risk value of the corresponding violating word, determine the risk contribution value of each word segment; In some embodiments, the risk contribution value of each word segmentation M i It can be represented as: .

[0072] in, Indicates the first j The industry-specific risk value of each prohibited keyword. n This indicates the number of prohibited words in the prohibited word list.

[0073] Step 206: Determine the text feature risk value based on the risk contribution value of each word segment and the word frequency weight of each violating word.

[0074] In some embodiments, word frequency weight is used to indicate the number of times a corresponding prohibited word appears in the text content. For example, the word frequency weight of a prohibited word that appears more than three times is 1.5, and the word frequency weight of a prohibited word that appears less than three times is 1. The higher the text feature risk value, the higher the text risk of the linked page.

[0075] In some embodiments, text feature risk value T risk It can be represented as: .

[0076] in, Indicates the first i The word frequency weight of each segment, m This indicates the number of words in the text content.

[0077] The method for determining text feature risk values, as shown in steps 201 to 206, first extracts and segments the text content of the linked page. Then, it combines the violation word vectors associated with the violation feature library of the target industry with the violation word library of the industry's basic risk value to determine the context correction coefficient of each segment relative to each violation word. Next, it accurately calculates semantic similarity based on the segment word vectors, violation word vectors, and context correction coefficients. Subsequently, it combines the semantic similarity with the industry basic risk value of the violation word to obtain the risk contribution value of each segment. Finally, it incorporates the word frequency weight, which indicates the number of times the violation word appears in the text, to determine the text feature risk value. This method effectively avoids the misjudgment problem caused by "one word with multiple meanings" in traditional keyword matching. Furthermore, through the accurate association of industry-specific violation words, the deep adaptation of contextual semantics, and the quantitative consideration of word frequency weight, it significantly improves the accuracy and industry adaptability of text feature risk identification. This provides more reliable text feature dimension support for the dynamic quantification of link risk, thereby ensuring the accuracy and efficiency of the overall link risk review.

[0078] Figure 3 This is a flowchart illustrating the method for determining image feature risk values ​​provided in an embodiment of this application.

[0079] In some embodiments, based on the above description of determining the risk value of risk characteristics, such as Figure 3 As shown, the process involves obtaining the global image and at least one sub-image from the image content of the linked page, determining the scaled dot product score of each sub-image relative to the global image, and determining the image feature risk value based on the scaled dot product score, violation confidence, and industry matching degree of each sub-image, including the following steps: Step 301: Extract the image content of the linked page, and obtain the global image and at least one sub-image from the image content; In some embodiments, a sub-image refers to an independent image element within the image content, such as the logo of the linking entity or the certification mark of a product.

[0080] Step 302: Extract the query vector corresponding to the global image and the key vector corresponding to each sub-image; In some embodiments, the query vector and the key vector have the same vector dimension, because if the query vector and the key vector have different vector dimensions, it is impossible to perform a scaling dot product operation on the query vector and the key vector.

[0081] In some embodiments, a linear transformation projection can be used to project the global image onto the query vector Q, and to project each sub-image onto its corresponding key vector K.

[0082] Step 303: For each sub-image, based on the key vector, query vector and vector dimension corresponding to the sub-image, determine the scaling dot product score of each sub-image relative to the global image; In some embodiments, the scaled dot product score of each sub-image relative to the global image. It can be represented as: .

[0083] in, Indicates the first i The key vectors corresponding to each sub-image Represents the vector dimension.

[0084] Step 304: Obtain the violation image library from the violation feature library; In some embodiments, each illegal image in the illegal image library is associated with a corresponding industry matching degree. Specifically, The semantic understanding model can be used to calculate the degree of matching between the illegal elements in each sub-image and the illegal images specific to the target industry in the illegal image library. For example, "fake financial regulatory agency logo" is 1 in the financial industry and 0.1 in the education industry.

[0085] Step 305: Based on the illegal images in the illegal image library, determine the illegality confidence of each sub-image and the corresponding industry matching degree; In some embodiments, the violation confidence level of each sub-image can be used Specifically, each sub-image can be used as input, and the industry-specific object detection model outputs whether the sub-image contains illegal images (such as pornography, violence, false labels, etc.), and finally outputs the violation confidence score of each sub-image. The violation confidence score ranges from [0,1], and the higher the violation confidence score, the greater the probability that the corresponding sub-image is illegal.

[0086] Step 306: Based on the scaled dot product score, violation confidence and industry matching degree of each sub-image, determine the normalized association weight of each sub-image relative to the global image; In some embodiments, the risk contribution of each sub-image relative to the global image can be determined based on the scaled dot product score, violation confidence, and industry matching degree of each sub-image. , It can be represented as: .

[0087] in, This represents the pre-set risk coefficient for image features of the target industry.

[0088] Then, for the current sub-image in each sub-image, based on the risk contribution of the current sub-image and the sum of the risk contributions of all sub-images, the normalized association weight of each sub-image relative to the global image is determined.

[0089] .

[0090] in, This represents the normalized association weight of the i-th sub-image. This represents the risk contribution of the i-th sub-image. This indicates the total number of sub-images. The larger the value, the more significant the impact of the risk feature of the i-th sub-image on the risk of the global image.

[0091] Step 307: Determine the image risk feature value based on the normalized association weight, violation confidence, and industry matching degree of each sub-image.

[0092] In some embodiments, image risk feature values It can be represented as: .

[0093] The larger the value, the higher the risk associated with the linked page's image. This is especially true when a sub-image contains a clear violation and is closely related to the global image. It will increase significantly; if the sub-image has no violations ( Even if it is 0), High, due to If the value is 0, the sub-image will not contribute any risk value; if the sub-image has violations but has a very weak correlation with the global value ( If the risk level is low, then the sub-image has a limited impact on the overall risk.

[0094] The method for determining image feature risk values, as shown in steps 301 to 307, extracts the global image and sub-images from the image content of the linked page. The global image is mapped to a query vector, and the sub-images are mapped to key vectors of the same dimension to ensure the effectiveness of feature comparison. Then, the scaling dot product score of each sub-image relative to the global image is calculated using the vector dimension. Simultaneously, the industry matching degree corresponding to the violation image in the violation feature library is correlated to determine the violation confidence and corresponding industry matching degree of the sub-image. The scaling dot product score, violation confidence, and industry matching degree are then fused to obtain the normalized association weight of the sub-image relative to the global image. Finally, the image risk feature value is determined based on this normalized association weight, violation confidence, and industry matching degree. This method achieves deep correlation analysis between the global image and sub-images and effectively improves the industry adaptability of image feature risk identification through accurate matching and quantitative consideration of industry-specific violation image features. It avoids the misjudgment or missed judgment problems caused by ignoring industry differences and the separation of global and local features in traditional image risk identification. It provides reliable image feature dimension support for the dynamic quantification of multimodal risks in links, further ensuring the accuracy and efficiency of overall link risk review.

[0095] Figure 4 This is a flowchart illustrating a method for determining the risk value of behavioral characteristics provided in an embodiment of this application. Interactive behaviors include the number of QR codes within a linked page and the redirection behavior of the linked page.

[0096] In some embodiments, based on the above description of determining the risk value of risk characteristics, such as Figure 4 As shown, the process of acquiring interactive behaviors generated during the access to linked pages and determining behavioral characteristic risk values ​​based on preset behavioral characteristic risk rules includes the following steps: Step 401: Obtain the number of redirects that occurred during the access to the linked page; and / or, identify the number of QR codes contained in the linked page; In some embodiments, the number of redirects is available. This indicates that the number of QR codes available is [number missing]. express.

[0097] Step 402: Determine the behavioral characteristic risk value based on the number and / or quantity of redirections, and based on the QR code quantity weight and redirection behavior weight configured according to the preset behavioral characteristic risk rules.

[0098] In some embodiments, the behavioral characteristic risk rule can be expressed as: .

[0099] in, Indicates the risk value of behavioral characteristics. , Weights for the number of QR codes and weights for redirection actions, respectively. , The value of must satisfy Constraints.

[0100] Understandable The higher the score, the greater the likelihood that the target link poses a risk of redirection.

[0101] The method for determining behavioral feature risk values, as shown in steps 401 and 402, determines the behavioral feature risk value by obtaining the number of redirects during the access to the linked page and identifying the number of QR codes contained in the linked page, and combining the QR code number weight and redirection behavior weight configured in the preset behavioral feature risk rules. This accurately captures the core interactive behaviors in the target link that are prone to hidden violations. By quantifying the weights, it achieves differentiated consideration of risk factors for different interactive behaviors. This avoids the omission of key risk behaviors or overgeneralization in traditional behavioral risk identification, and improves the objectivity and operability of behavioral feature risk assessment by relying on clear quantitative indicators and weight configurations. It effectively supports the comprehensive quantification of multimodal link risks, further ensuring the accuracy and efficiency of the overall link risk review, and adapting to the need for rapid and accurate determination of behavioral feature risks in high-concurrency scenarios.

[0102] Figure 5 This is a flowchart illustrating the method for determining an initial risk value provided in an embodiment of this application.

[0103] In some embodiments, such as Figure 5 As shown, step 103 includes the following steps: Step 501: Obtain historical link violation data for the target industry; In some embodiments, historical link violation data includes the number of text content violation cases. Number of cases of image content violations and the number of cases of behavioral violations .

[0104] Step 502: Based on the number of text content violation cases, image content violation cases, and behavioral violation cases in the historical link violation data, determine the dimensional feature weights of each dimension feature; In some embodiments, the dimensional feature weights of text features It can be represented as: .

[0105] Dimensional feature weights of image features It can be represented as: .

[0106] Dimensional feature weights of behavioral features It can be represented as: .

[0107] Based on this, step 502 includes: Based on the number of text content violation cases, image content violation cases, and behavioral violation cases in historical link violation data, the number of text content violation cases, image content violation cases, and behavioral violation cases are normalized respectively to obtain the normalized values ​​corresponding to the number of text content violation cases, image content violation cases, and behavioral violation cases. Determine the normalized values ​​corresponding to the number of text content violation cases, the number of image content violation cases, and the number of behavioral violation cases, respectively, which are the text feature weights, image feature weights, and behavioral feature weights.

[0108] In some embodiments, operators are supported to manually configure... , and Perform fine-tuning (adjustment range ≤ ±0.1), record the link review accuracy rate after fine-tuning, and update the link review accuracy rate using the fine-tuned link review accuracy rate. , and .

[0109] Step 503: Determine the initial risk value of the target link based on the risk value of each dimension feature and the dimensional feature weight of each dimension feature.

[0110] In some embodiments, the initial risk value It can be represented as: .

[0111] The method for determining the initial risk value, as shown in steps 501 to 503, obtains historical link violation data of the target industry, determines the dimensional feature weights of each dimension based on the number of text content violation cases, image content violation cases, and behavioral violation cases, and then determines the initial risk value of the target link by combining the risk values ​​of each dimension feature. This achieves a precise match between the dimensional feature weights and industry risk characteristics, avoiding the problem caused by the fixed weight model ignoring the differences in industry violation characteristics. At the same time, the weight calculation logic built on historical violation data makes the quantification of the initial risk value more objective and targeted, effectively improving the accuracy of link risk quantification and further ensuring the scientific and efficient nature of the overall link risk review.

[0112] Figure 6 A flowchart illustrating the method for determining a standard risk value provided in an embodiment of this application.

[0113] In some embodiments, such as Figure 6As shown, step 104 includes the following steps: Step 601: Obtain the historical risk value distribution of the target industry; In some embodiments, the historical risk value distribution can be a standard risk value dataset of all audited links in the target industry.

[0114] In some embodiments, the historical risk value distribution of the target industry within a preset time period can be obtained, such as the historical risk value distribution of the past 3 months.

[0115] Step 602: Determine the preset quantile value in the historical risk value distribution as the risk normalization factor for the target industry; In some embodiments, the preset quantile can be any quantile greater than 90% and less than 100%.

[0116] In some embodiments, the risk normalization factor can be expressed as .

[0117] in, This represents a dataset of standard risk values ​​for all approved links in the target industry over the past three months. Take the 95th percentile of the dataset.

[0118] Step 603: Based on the risk normalization factor, normalize the initial risk value to obtain the normalized initial risk value; In some embodiments, the ratio of the initial risk value to the risk normalization factor can be used as the normalized initial risk value.

[0119] Step 604: Determine the smaller of the normalized initial risk value and the preset risk threshold as the standard risk value for the target link.

[0120] In some embodiments, standard risk value It can be represented as: .

[0121] in, Indicates the initial risk value. This is a preset risk threshold. It is understood that the preset risk threshold can be adjusted as needed.

[0122] Figure 7 This is a flowchart illustrating a method for determining whether a target link is a risky link, as provided in an embodiment of this application.

[0123] In some embodiments, such as Figure 7 As shown, step 105 includes the following steps: Step 701: Determine whether the standard risk value is greater than the risk threshold; Step 702: If the judgment result is yes, the target link is determined to be a suspicious and risky link; In some embodiments, if the determination result is negative, the target link is determined to be a safe link.

[0124] Step 703: Issue a review prompt for the target link; In some embodiments, the review prompt is used to remind operators to manually review the target link. The review prompt can be issued in ways including but not limited to issuing a voice prompt or displaying the review prompt on the human-computer interaction interface.

[0125] Step 704: In response to the review approval operation for the review prompt, determine the target link as a safe link; or, in response to the review disapproval operation for the review prompt, determine the target link as a risky link.

[0126] In some embodiments, the operation in response to the review prompt is performed by the operations personnel, that is, the review personnel perform the operation in response to the review prompt through the human-computer interaction interface or voice command, such as the confirmation operation (review passed operation) or the cancellation operation (review failed operation).

[0127] In some embodiments, if the target link is a secure link, then the delivery of the target link is permitted; if the target link is a risky link, then the delivery of the target link is not permitted.

[0128] In some embodiments, the risk link identification method provided in this application can be applied to an Identity as a Service (IDaaS) platform and executed by an IDaaS server as the execution subject.

[0129] Specifically, the IDaaS platform's link management function is built on the MetaTrust IDaaS platform. It allows customers to register on the IDaaS platform, report the identity of the link placement entity, and conduct risk audits on links uploaded by the placement entity. Through snapshot comparison and other operations, it achieves secure link management. Currently, this function has been implemented in collaboration with external clients, effectively intercepting illegal link activity and ensuring the security of business subscriptions by relying on the link placement entity identity verification and link risk identification mechanisms.

[0130] Figure 8 This is a flowchart illustrating the method for receiving a target link provided in an embodiment of this application.

[0131] Based on this, in some embodiments, the risky link identification method provided in this application is applied to an IDaaS server; correspondingly, such as Figure 8 As shown, step 101 includes the following steps: Step 801: Receive the tenant's delivery request; In some embodiments, the delivery request includes at least the target industry of the link delivery entity to which the link is to be delivered, and the qualification information of the link delivery entity.

[0132] In some embodiments, the delivery request may be initiated by a tenant of the IDaaS platform. Specifically, taking a link as an advertisement as an example: The advertising platform (the tenant of the IDaaS platform) completes tenant creation on the Meta-Trust IDaaS platform by carrying the unique Application Program Identification (APPID) applied for on the Capability Open Platform. This establishes a dedicated business operation entity and permission boundaries, providing basic identity support for subsequent advertiser (link delivery entity) management, link review, and billing traceability. After tenant creation, the advertising platform can further create advertiser accounts on the IDaaS platform, and must explicitly select the target industry of the advertiser (e.g., finance-wealth management, e-commerce-fresh food, etc.). The IDaaS server automatically associates the corresponding Industry-Specific Violation Feature Library (ISVFL) based on the selected target industry. The advertising platform also needs to submit advertiser qualification documents (e.g., regulatory filing documents for the financial industry, business licenses for the e-commerce industry) and other qualification information.

[0133] Step 802: Based on the qualification information of the link placement entity and the list of non-compliant institutions in the non-compliance feature database of the target industry, determine whether the qualification of the link placement entity is compliant. In some embodiments, the IDaaS server compares the advertiser's qualification information with the list of non-compliant organizations in ISVFL to determine whether the advertiser's qualifications are compliant.

[0134] Step 803: If the qualifications of the link placement entity are compliant, generate and send the link placement entity identifier to the tenant. In some embodiments, if the qualifications of the linking entity are compliant, an advertiser identifier is generated and fed back to the tenant, and the advertiser identifier is bound to the APPID.

[0135] Step 804: Receive the tenant's link reporting request. The link reporting request shall include at least the identifier of the link delivery entity and the target link.

[0136] In some embodiments, after an advertiser is created, the advertising platform can upload and register the link. The advertising platform can register the link on the IDaaS platform or by calling the IDaaS interface. When registering, the platform needs to upload the complete target link, the corresponding domain name, the advertiser ID, the APPID and other relevant information.

[0137] To facilitate a further understanding of the technical solution of this application, a specific example is provided below to further describe the risky link identification method provided in the embodiments of this application. Specifically, in this example, the risky link identification method is applied to the IDaaS platform, the tenant is the advertising platform, and the link placement entity is the advertiser.

[0138] Figure 9 This is a flowchart illustrating a risk link identification method provided as an example in this application.

[0139] like Figure 9 As shown, an example of the risk link identification method provided in this application includes: Step 901: The advertising platform creates a tenant on the IDaaS platform; Step 902: The advertising platform uploads the advertiser's qualification information to the IDaaS platform. After the IDaaS platform approves the qualification information, it sends the advertiser identifier to the advertising platform. Step 903: After the advertising platform reports the request link to the IDaaS platform, it uploads the target ad link that the advertiser wants to place. Step 904: The IDaaS platform extracts text features, image features, and behavioral features from the linked pages, and calculates the risk values ​​of the text features, image features, and behavioral features based on ISVFL. Step 905: The IDaaS platform calculates the initial risk value of the target ad link based on the risk values ​​of text features, image features, and behavioral features, as well as the dynamic dimensional feature weights corresponding to the text features, image features, and behavioral features. Step 906: The IDaaS platform determines the risk normalization factor based on the historical risk value distribution of the target industry's links, and normalizes the initial risk value based on the risk normalization factor to obtain the standard risk value of the target advertising link. Step 907: Determine whether the standard risk value exceeds the risk threshold of the target industry; If the judgment result is yes, proceed to step 908; If the result is negative, proceed to step 910; Step 908: Determine the target ad link as a suspicious or risky link and conduct a manual review of the target ad link; Step 909: Determine whether the manual review result is acceptable; If the judgment result is yes, proceed to step 910; If the result is negative, proceed to step 911; Step 910: Determine if the target ad link is a safe link; Step 911: Determine if the target ad link is a risky link.

[0140] To implement the risk link identification method provided in this application embodiment, this application embodiment also provides a risk link identification device. Figure 10 This is a schematic diagram of a risk link identification device provided in an embodiment of this application. Figure 10 As shown, the risk link identification device includes: The link receiving module 1001 is used to receive the target link and the industry information of the target industry to which the target link belongs; The dimensional feature risk value determination module 1002 is used to obtain the multi-dimensional features of the linked page indicated by the target link, and determine the risk value of each dimension feature in the multi-dimensional features based on the violation feature library of the target industry; the multi-dimensional features include at least the text features, image features and behavioral features of the linked page; the violation features in the violation feature library of different industries are different; The initial risk value determination module 1003 is used to determine the initial risk value of the target link based on the risk values ​​of features in each dimension. The standard risk value determination module 1004 is used to normalize the initial risk value based on the risk normalization factor of the target industry to obtain the standard risk value of the target link; the risk normalization factor is used to indicate the historical risk value distribution of the link in the target industry; The link identification module 1005 is used to determine whether a target link is a risky link based on the standard risk value of the target link and the risk threshold of the target industry.

[0141] In some embodiments, the dimension feature risk value determination module 1002 is specifically used for: Get at least one word segment from the text content of the linked page, determine the semantic similarity between the word segment and the illegal words in the violation feature library, and determine the text feature risk value based on the semantic similarity and the industry basic risk value of each illegal word. Obtain the global image and at least one sub-image from the image content of the linked page, determine the scaling dot product score of each sub-image relative to the global image, and determine the image feature risk value based on the scaling dot product score, violation confidence, and industry matching degree of each sub-image; wherein, the violation confidence is used to indicate whether the sub-image contains a violation image from the violation feature library; the industry matching degree is used to indicate the degree of matching between the violation image contained in the sub-image and the target industry; The system acquires interactive behaviors generated during the access to linked pages and determines the behavioral characteristic risk value based on preset behavioral characteristic risk rules.

[0142] In some embodiments, the dimensional feature risk value determination module 1002 is further specifically used for: Extract the text content from the linked page, perform word segmentation on the text content, and obtain at least one word; Obtain the violation term library from the violation feature library of the target industry; each violation term in the violation term library is associated with a corresponding violation term vector and the basic risk value of the industry; Determine the context correction coefficient of each word segment relative to each violating word in the violation lexicon; Based on the word vectors corresponding to each word segment, the word vectors corresponding to each violating word, and the context correction coefficient, the semantic similarity between each word segment and each violating word is determined.

[0143] In some embodiments, the dimensional feature risk value determination module 1002 is further specifically used for: Based on the semantic similarity between each word segment and each violating word, and the industry-based basic risk value of the corresponding violating word, the risk contribution value of each word segment is determined; The text feature risk value is determined based on the risk contribution value of each word segment and the word frequency weight of each violating word; whereby the word frequency weight is used to indicate the number of times the corresponding violating word appears in the text content.

[0144] In some embodiments, the dimensional feature risk value determination module 1002 is further specifically used for: Extract the image content from the linked page, and obtain the global image and at least one sub-image from the image content; Extract the query vector corresponding to the global image and the key vector corresponding to each sub-image; the query vector and the key vector have the same vector dimension. For each sub-image, the scaling dot product score of each sub-image relative to the global image is determined based on the key vector, query vector, and vector dimension of the sub-image.

[0145] In some embodiments, the dimensional feature risk value determination module 1002 is further specifically used for: Obtain the violation image library from the violation feature library; each violation image in the violation image library is associated with a corresponding industry matching degree; Based on the illegal images in the illegal image library, determine the illegality confidence of each sub-image and the corresponding industry matching degree; Based on the scaled dot product score, violation confidence, and industry matching degree of each sub-image, the normalized association weight of each sub-image relative to the global image is determined. Based on the normalized association weights, violation confidence, and industry matching degree of each sub-image, the risk feature values ​​of the images are determined.

[0146] In some embodiments, the dimensional feature risk value determination module 1002 is further specifically used for: Acquire interactive behaviors generated during the access to linked pages, and determine behavioral characteristic risk values ​​based on preset behavioral characteristic risk rules, including: Get the number of redirects that occurred during the access to the linked page; and / or, identify the number of QR codes contained in the linked page; Based on the number and / or quantity of redirections, and the QR code quantity weight and redirection behavior weight configured according to the preset behavioral characteristic risk rules, the behavioral characteristic risk value is determined.

[0147] In some embodiments, the initial risk value determination module 1003 is specifically used for: Obtain historical link violation data for the target industry; Based on the number of text content violation cases, image content violation cases, and behavioral violation cases in historical link violation data, the dimensional feature weights of each dimension are determined. The initial risk value of the target link is determined based on the risk value of each dimension feature and the dimensional feature weight of each dimension feature.

[0148] In some embodiments, the initial risk value determination module 1003 is further specifically used for: Based on the number of text content violation cases, image content violation cases, and behavioral violation cases in historical link violation data, the number of text content violation cases, image content violation cases, and behavioral violation cases are normalized respectively to obtain the normalized values ​​corresponding to the number of text content violation cases, image content violation cases, and behavioral violation cases. Determine the normalized values ​​corresponding to the number of text content violation cases, the number of image content violation cases, and the number of behavioral violation cases, respectively, which are the text feature weights, image feature weights, and behavioral feature weights.

[0149] In some embodiments, the standard risk value determination module 1004 is specifically used for: Obtain the historical risk value distribution of the target industry; Determine the preset quantile value in the historical risk value distribution as the risk normalization factor for the target industry; Based on the risk normalization factor, the initial risk value is normalized to obtain the normalized initial risk value; The smaller of the normalized initial risk value and the preset risk threshold is determined as the standard risk value for the target link.

[0150] In some embodiments, the link identification module 1005 is specifically used for: Determine whether the standard risk value is greater than the risk threshold; If the judgment result is yes, the target link is determined to be a suspicious and risky link; A review prompt was issued for the target link; In response to a successful review prompt, the target link is determined to be a safe link; or, in response to a failed review prompt, the target link is determined to be a risky link.

[0151] In some embodiments, the link receiving module 1001 is specifically used for: Receive delivery requests from tenants; the delivery request must include at least the target industry of the entity to which the link to be delivered belongs, and the qualification information of the entity to which the link is delivered; Based on the qualification information of the link placement entity and the list of non-compliant institutions in the non-compliance feature database of the target industry, determine whether the qualification of the link placement entity is compliant. If the entity that placed the link is qualified, generate and send the entity's link identifier to the tenant. Receive link reporting requests from tenants. The link reporting request must include at least the identifier of the link delivery entity and the target link.

[0152] The methods and apparatus provided in the embodiments of this application have been described above. To implement the functions of the methods provided in the embodiments of this application, the risk link identification apparatus may include hardware structures and software modules, implementing the above functions in the form of hardware structures, software modules, or a combination of hardware structures and software modules. One of the above functions may be executed in the form of hardware structures, software modules, or a combination of hardware structures and software modules.

[0153] Figure 11 This is a block diagram illustrating an electronic device 1100 for implementing the above-described trajectory repair model training method, according to an exemplary embodiment. For example, the electronic device 1100 may be a computer, a personal digital assistant, etc.

[0154] Reference Figure 5 The electronic device 1100 may include a communication interface 1101, capable of interacting with other devices; a processor 1102, connected to the communication interface 1101 to interact with other devices, used to execute the methods provided by one or more of the above-described technical solutions when running a computer program; and a memory 1103, on which the computer program is stored. Specifically, the specific processing operations of the processor 1102 can refer to the risk link identification method described in the above embodiments of this disclosure.

[0155] Of course, in practical applications, the various components in electronic device 1100 are coupled together through bus system 1104. It can be understood that bus system 1104 is used to realize the connection and communication between these components. In addition to a data bus, bus system 1104 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 5The general designated all buses as Bus System 1104.

[0156] The memory 1103 in this embodiment is used to store various types of data to support the operation of the electronic device 1100. Examples of such data include any computer program used to operate on the electronic device 1100.

[0157] The methods disclosed in the embodiments of this application can be applied to processor 1102, or implemented by processor 1102. Processor 1102 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 1102 or by instructions in software form. The processor 1102 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 1102 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 1103. Processor 1102 reads information from memory 1103 and completes the steps of the aforementioned method in conjunction with its hardware.

[0158] In an exemplary embodiment, the electronic device 1100 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0159] Embodiments of this disclosure also propose a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the risk link identification method described in the above embodiments of this disclosure.

[0160] Embodiments of this disclosure also propose a computer program product, including a computer program that, when executed by a processor, implements the risk link identification method described in the above embodiments of this disclosure.

[0161] Embodiments of this disclosure also propose a chip including one or more interface circuits and one or more processors; the interface circuits are used to receive signals from the memory of an electronic device and send signals to the processors, the signals including computer instructions stored in the memory, which, when executed by the processor, cause the electronic device to perform the risk link identification method described in the above embodiments of this disclosure.

[0162] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0163] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0164] Any description of operation or method in the flowchart or otherwise described herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or operation, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0165] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processing module, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (control method), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic device, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0166] It should be understood that various parts of the embodiments of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0167] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by instructing related hardware through an operation sequence, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0168] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc.

[0169] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for identifying risky links, characterized in that, The method includes: Receive the target link and the industry information of the target industry to which the target link belongs; The multi-dimensional features of the linked page indicated by the target link are obtained, and the risk value of each dimension feature in the multi-dimensional features is determined based on the violation feature library of the target industry; the multi-dimensional features include at least the text features, image features and behavioral features of the linked page; the violation features in the violation feature library of different industries are different; Based on the risk values ​​of each of the aforementioned dimensional features, the initial risk value of the target link is determined; Based on the risk normalization factor of the target industry, the initial risk value is normalized to obtain the standard risk value of the target link; the risk normalization factor is used to indicate the historical risk value distribution of the link in the target industry. Based on the standard risk value of the target link and the risk threshold of the target industry, determine whether the target link is a risky link.

2. The method according to claim 1, characterized in that, The process of obtaining multi-dimensional features of the linked page indicated by the target link, and determining the risk value of each dimension of the multi-dimensional features based on the violation feature library of the target industry, includes: At least one word segment is obtained from the text content of the linked page, the semantic similarity between the word segment and the illegal words in the violation feature library is determined, and the text feature risk value is determined based on the semantic similarity and the industry basic risk value of each illegal word. The system acquires a global image and at least one sub-image from the image content of the linked page, determines the scaling dot product score of each sub-image relative to the global image, and determines an image feature risk value based on the scaling dot product score, violation confidence, and industry matching degree of each sub-image; wherein, the violation confidence is used to indicate whether the sub-image contains a violation image from the violation feature library; and the industry matching degree is used to indicate the degree of matching between the violation image contained in the sub-image and the target industry. The system acquires the interactive behaviors generated during the access to the linked page and determines the behavioral characteristic risk value based on preset behavioral characteristic risk rules.

3. The method according to claim 2, characterized in that, The step of obtaining at least one word segment from the text content of the linked page and determining the semantic similarity between the word segment and the violating words in the violation feature library includes: Extract the text content of the linked page, perform word segmentation on the text content, and obtain at least one word segment; Obtain the violation word library from the violation feature library of the target industry; wherein, each violation word in the violation word library is associated with a corresponding violation word vector and an industry basic risk value; Determine the context correction coefficient of each word segment relative to each violating word in the violating word library; The semantic similarity between each segmented word and each violating word is determined based on the segmented word vector corresponding to each segmented word, the violating word vector corresponding to each violating word, and the context correction coefficient.

4. The method according to claim 2, characterized in that, The determination of text feature risk values ​​based on the semantic similarity and the industry-based basic risk values ​​of each of the aforementioned violating words includes: Based on the semantic similarity between each of the word segments and each of the violating words, and the industry-based basic risk value of the corresponding violating words, the risk contribution value of each of the word segments is determined; The text feature risk value is determined based on the risk contribution value of each segmented word and the word frequency weight of each violating word; wherein, the word frequency weight is used to indicate the number of times the corresponding violating word appears in the text content.

5. The method according to claim 2, characterized in that, The step of obtaining the global image and at least one sub-image from the image content of the linked page, and determining the scaling dot product score of each sub-image relative to the global image, includes: Extract the image content of the linked page, and obtain the global image and at least one sub-image from the image content; Extract the query vector corresponding to the global image and the key vector corresponding to each of the sub-images; the query vector and the key vector have the same vector dimension. For each of the sub-images, based on the key vector, the query vector, and the vector dimension corresponding to the sub-image, the scaling dot product score of each sub-image relative to the global image is determined.

6. The method according to claim 2, characterized in that, The determination of image feature risk values ​​based on the scaled dot product score, violation confidence, and industry matching degree of each sub-image includes: Obtain the violation image library from the violation feature library; wherein, each violation image in the violation image library is associated with a corresponding industry matching degree; Based on the illegal images in the illegal image library, determine the illegality confidence of each sub-image and the corresponding industry matching degree; Based on the scaled dot product score, violation confidence, and industry matching degree of each sub-image, the normalized association weight of each sub-image relative to the global image is determined; The image risk feature value is determined based on the normalized association weight, violation confidence, and industry matching degree of each sub-image.

7. The method according to claim 2, characterized in that, The interactive behavior includes the number of QR codes within the linked page and the redirection behavior of the linked page; The step of acquiring the interactive behaviors generated during the access to the linked page and determining the behavioral characteristic risk value based on preset behavioral characteristic risk rules includes: Obtain the number of redirects that occurred during access to the linked page; and / or, identify the number of QR codes contained in the linked page; Based on the number of redirections and / or the quantity, and the QR code quantity weight and redirection behavior weight configured according to the preset behavioral characteristic risk rules, the behavioral characteristic risk value is determined.

8. The method according to claim 1, characterized in that, Determining the initial risk value of the target link based on the risk values ​​of each of the aforementioned dimensional features includes: Obtain historical link violation data for the target industry; Based on the number of text content violation cases, image content violation cases, and behavioral violation cases in the historical link violation data, the dimensional feature weights of each dimensional feature are determined. Based on the risk value of each dimension feature and the dimensional feature weight of each dimension feature, the initial risk value of the target link is determined.

9. The method according to claim 8, characterized in that, The determination of the dimensional feature weights for each dimension feature based on the number of text content violation cases, image content violation cases, and behavioral violation cases in the historical link violation data includes: Based on the number of text content violation cases, image content violation cases, and behavioral violation cases in the historical link violation data, the number of text content violation cases, image content violation cases, and behavioral violation cases are normalized respectively to obtain the normalized values ​​corresponding to the number of text content violation cases, image content violation cases, and behavioral violation cases. The normalized values ​​corresponding to the number of text content violation cases, the number of image content violation cases, and the number of behavior violation cases are determined as text feature weights, image feature weights, and behavior feature weights, respectively.

10. The method according to claim 1, characterized in that, The process of normalizing the initial risk value based on the risk normalization factor of the target industry to obtain the standard risk value of the target link includes: Obtain the historical risk value distribution of the target industry; Determine a preset quantile value in the distribution of historical risk values ​​as the risk normalization factor for the target industry; Based on the risk normalization factor, the initial risk value is normalized to obtain the normalized initial risk value. The smaller of the normalized initial risk value and the preset risk threshold is determined as the standard risk value of the target link.

11. The method according to any one of claims 1 to 10, characterized in that, The determination of whether a target link is a risky link based on the standard risk value of the target link and the risk threshold of the target industry includes: Determine whether the standard risk value is greater than the risk threshold; If the judgment result is yes, the target link is determined to be a suspicious and risky link; A review prompt was issued for the target link; In response to a successful review following the review prompt, the target link is determined to be a safe link; or, in response to a failed review following the review prompt, the target link is determined to be a risky link.

12. The method according to any one of claims 1 to 10, characterized in that, The method described above is applied to Identity as a Service (IDaaS) servers; The receiving of the target link, and the industry information of the target industry to which the target link belongs, includes: Receive a tenant's delivery request; the delivery request shall include at least the target industry of the link delivery entity to which the link is to be delivered, and the qualification information of the link delivery entity; Based on the qualification information of the link placement entity and the list of non-compliant organizations in the violation feature database of the target industry, it is determined whether the qualification of the link placement entity is compliant. If the qualifications of the link delivery entity are compliant, a link delivery entity identifier is generated and fed back to the tenant; The system receives a link reporting request from the tenant, which includes at least the identifier of the link delivery entity and the target link.

13. A risk link identification device, characterized in that, The device includes: The link receiving module is used to receive the target link and the industry information of the target industry to which the target link belongs; The dimensional feature risk value determination module is used to acquire multi-dimensional features of the linked page indicated by the target link, and determine the risk value of each dimension feature based on the violation feature library of the target industry; the multi-dimensional features include at least the text features, image features and behavioral features of the linked page; the violation features in the violation feature library of different industries are different; The initial risk value determination module is used to determine the initial risk value of the target link based on the risk values ​​of each of the aforementioned dimensional features; The standard risk value determination module is used to normalize the initial risk value based on the risk normalization factor of the target industry to obtain the standard risk value of the target link; the risk normalization factor is used to indicate the historical risk value distribution of the link in the target industry. The link identification module is used to determine whether the target link is a risky link based on the standard risk value of the target link and the risk threshold of the target industry.

14. An electronic device, characterized in that, include: A processor and a memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, performs the method of any one of claims 1 to 12.

15. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 12.

16. A computer program product comprising computer-executable instructions, characterized in that, When the computer-executable instructions are executed by a processor, they implement the method of any one of claims 1 to 12.

Images