A telecom fraud website detection method based on growing incremental learning

Abstract

A kind of telecom fraud website detection method based on growth incremental learning, comprising the following steps: step 1, based on Sentence Transformer model, convert telecom fraud website data into graph structure representation;Step 2, construct GAT graph feature extraction model;GAT graph feature extraction model is trained through graph structure representation, and the graph feature of telecom fraud website is learned;Step 3, based on growth incremental learning method, makes GAT graph feature extraction model carry out incremental learning to current incremental task;Using the GAT graph feature extraction model trained to extract new telecom fraud website features, detect new telecom fraud website.The present application provides a kind of telecom fraud website detection method based on growth incremental learning, can accurately identify different types of fraud website, and can be realized through the method of incremental learning to the continuous detection of new fraud website.

Description

Technical Field

[0001] This invention relates to the fields of network security technology, website detection, and incremental detection, and in particular to a method for detecting telecommunications fraud websites based on growth-based incremental learning. Background Technology

[0002] With the rapid popularization of 5G technology, social media and short video platforms have become an indispensable part of people's lives, entertainment, and even work. While users acquire massive amounts of information on these platforms, they may also intentionally or unintentionally leak sensitive data, including geographical location, consumption preferences, and social relationships, thus creating potential risks for telecommunications fraud.

[0003] The shortcomings of existing telecom fraud website detection technologies lie in their inability to accurately identify different types of fraudulent websites and their lack of continuous detection capabilities for new types of fraudulent websites. This is due to: 1. The complexity and diversity of fraudulent website domains and the wide variety of fraud types make it difficult for traditional detection methods to effectively analyze their behavioral patterns; 2. Fraudsters often design new types of fraudulent websites to bypass the identification of existing detection models, causing traditional detection methods to fail; 3. Influenced by factors such as changes in law enforcement priorities and social attention, certain types of fraudulent websites may account for an excessively high proportion in the dataset during a specific period, resulting in an unbalanced distribution of collected data, which in turn reduces the performance and generalization ability of the detection model. Summary of the Invention

[0004] In view of the above-mentioned deficiencies of the prior art, the present invention provides a method for detecting telecommunications fraud websites based on growth-based incremental learning, which can accurately identify different types of fraud websites and can achieve continuous detection of new types of fraud websites through incremental learning.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A method for detecting telecom fraud websites based on growth-based incremental learning includes the following steps:

[0007] Step 1: Convert the data of telecom fraud websites into a graph structure representation based on the Sentence Transformer model;

[0008] Step 2: Construct the GAT graph feature extraction model; train the GAT graph feature extraction model using the graph structure representation to learn the graph features of telecom fraud websites;

[0009] Step 3: Based on the growth-based incremental learning method, the GAT graph feature extraction model is incrementally learned for the current incremental task; the trained GAT graph feature extraction model is used to extract features of new types of telecom fraud websites and detect new types of telecom fraud websites.

[0010] Preferably, step 1 includes:

[0011] Step 1.1: Use web crawling technology to obtain the URLs, webpage content, and WHOIS information of telecom fraud websites;

[0012] Step 1.2: Represent the URL and webpage content based on the Sentence Transformer model to obtain website semantic features; perform feature mapping on WHOIS information to obtain WHOIS features; perform feature fusion on the website semantic features and the WHOIS features to generate fused features;

[0013] Step 1.3: Construct the graph structure representation based on the fusion features.

[0014] Preferably, in step 1.2, for the URL and webpage content of the telecom fraud website, a Sentence Transformer model with pre-trained weights of "paraphrase-multilingual-MiniLM-L12-v2" is used to extract the semantic features of the website; for the WHOIS information of the telecom fraud website, feature mapping is performed based on the following three aspects: whether the domain name registration time exceeds 6 months, whether the location is located in an area with weak judicial supervision, and the completeness of the WHOIS information, and a 3-dimensional feature vector is constructed accordingly as the WHOIS feature; the website semantic features and the WHOIS features are fused through feature concatenation.

[0015] Preferably, in step 1.3, in the graph structure representation, each fraudulent website is represented as a node, and its fusion feature is used as the node feature; the cosine similarity between any two nodes is calculated as the association metric between nodes; the edges of the graph are constructed based on the association metric, and finally the graph structure representation of the telecommunications fraud website data is obtained.

[0016] Preferably, step 3 includes:

[0017] Step 3.1: Construct the GAT graph feature extraction model for the current task and initialize its parameters;

[0018] Step 3.2: Calculate the classification cross-entropy loss L1 between the prediction result of the GAT graph feature extraction model for the current task and the true classification label;

[0019] Step 3.3: Calculate the weight coefficients of the input samples based on the gradient information of the classification cross-entropy loss L1;

[0020] Step 3.4: Calculate the migration loss L2 between the prediction result of the current task model and the prediction result of the previous incremental task GAT graph feature extraction model, and adjust the migration loss L2 using the weight coefficients.

[0021] Step 3.5: Combine the classification cross-entropy loss L1 and the transfer loss L2 to optimize the GAT graph feature extraction model for the current task;

[0022] Step 3.6: Based on the experience replay strategy, select and store representative samples of the current incremental task for replay in subsequent incremental learning.

[0023] Preferably, in step 3.1, the GAT graph feature extraction model from the previous incremental task is used. The model parameters for the GAT graph feature extraction model for the current task Perform initialization.

[0024] Preferably, step 3.2 includes:

[0025] The current incremental task The sample and the replay sample of the previous incremental task Simultaneously input the GAT graph feature extraction model of the current task. The model trained on the previous t-1 old tasks middle

[0026] The GAT graph feature extraction model for the current task The output, compared with the model trained on the previous t-1 old tasks. The output is concatenated to obtain the predicted fusion features, and the classification cross-entropy loss L1 is calculated by using the classifier and the true classification label.

[0027] Preferably, step 3.3 includes:

[0028] Calculate the gradient information of each input sample in the classification cross-entropy loss L1, and calculate its weight coefficient in combination with the number of samples in the task to which the sample belongs.

[0029] Preferably, step 3.4 includes:

[0030] Calculate the GAT graph feature extraction model for the current task. The output of the model trained on the previous t-1 old tasks The KL divergence between the outputs is used as the migration loss L2, and the migration loss L2 is weighted and adjusted using the weighting coefficients.

[0031] Preferably, step 3.6 includes:

[0032] In the current incremental task After training, calculate the current incremental task. The mean vector of all samples; calculate the mean vector and... The Euclidean distance of all samples; randomly retain K / t replay samples from the first t-1 old tasks in the replay sample set, and delete the remaining samples; from the current incremental task From the sample set, select K / t samples with the smallest Euclidean distance from the mean vector and add them to the replay sample set M.

[0033] Compared with the prior art, the beneficial effects of the present invention are reflected in:

[0034] 1. Accurate Detection of Telecom Fraud Websites. First, the URLs and webpage content of fraudulent websites are input into a Sentence Transformer model in the form of "URL + [SEP] + webpage content". Then, leveraging the powerful semantic modeling capabilities of the Sentence Transformer model, the semantic relationship between the URL and webpage content is learned, yielding website semantic features. Subsequently, WHOIS information is feature-mapped to obtain WHOIS features, which are then fused with the website semantic features through feature concatenation. Based on the fused features, the cosine similarity between websites is calculated, thus constructing a graph structure representation of the fraudulent websites. Finally, this graph structure representation is used to train a GAT graph feature extraction model, and the model is continuously optimized based on the loss between the classifier's predicted labels and the true labels. Because the features of telecom fraud websites are derived from the fusion of multi-source information, and GAT can capture the graph topological relationships of different types of fraudulent websites, accurate classification can still be achieved even with complex and diverse domain names and numerous types of fraud.

[0035] 2. Continuous detection of new types of telecom fraud websites. An incremental learning method based on structure growth is used for the current incremental task. Training the corresponding GAT graph feature extraction model First, the current task GAT graph feature extraction model is used. The output is consistent with all old task models. The output features are concatenated to obtain fused features, and the classification cross-entropy loss L1 is calculated using a classifier and the true classification labels. Then, based on the gradient information of the classification cross-entropy loss L1, the weight coefficients of the input samples are calculated. Subsequently, the current model is calculated. The output is consistent with all old task models. The KL divergence between outputs is used as the transfer loss L2, and L2 is weighted and adjusted using the aforementioned weight coefficients to mitigate the performance degradation caused by data imbalance while ensuring that prior knowledge is not overwritten. Finally, the cross-entropy loss L1 and transfer loss L2 are combined to improve the GAT graph feature extraction model for the current task. Optimization is then performed. Through the aforementioned growth-based incremental learning method, the detection model can effectively mitigate catastrophic forgetting while continuously detecting new types of telecom fraud websites. Attached Figure Description

[0036] Figure 1 This is a framework diagram of the GAT graph feature extraction model in Embodiment 1 of the present invention;

[0037] Figure 2 This is a framework diagram of the growth-based incremental learning method according to Embodiment 1 of the present invention;

[0038] Figure 3 This is a heatmap of the confusion matrix of the classification results in Embodiment 1 of the present invention;

[0039] Figure 4 This is a T-SNE visualization of the classification results in Embodiment 1 of the present invention. Detailed Implementation

[0040] To make the technical means, inventive features, objectives, and effects of the invention readily understandable, the invention is further described below with reference to specific illustrations. However, the invention is not limited to the embodiments described below.

[0041] It should be noted that the structures, proportions, sizes, etc., illustrated in the accompanying drawings of this specification are only used to complement the content disclosed in the specification for those skilled in the art to understand and read, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0042] Considering the shortcomings of existing telecom fraud detection models in terms of accurate identification and continuous detection, this patent proposes a telecom fraud website detection model based on growth-based incremental learning. Leveraging the powerful semantic representation capabilities of the Sentence Transformer model, it delves into the semantic relationships between the URLs of telecom fraud websites and their webpage content. Simultaneously, WHOIS information is integrated to obtain a more comprehensive fusion feature profile of fraud websites. Subsequently, using this fusion feature, a graph structure representation of fraud websites is constructed, and the GAT graph feature extraction model is used to learn the graph topological relationships of different types of fraud websites. Even with complex and diverse domain names and numerous fraud types, accurate classification can still be achieved. Finally, using the online update mechanism of incremental learning technology, a telecom fraud website detection model with both accurate identification and continuous detection capabilities is trained, providing real-time technical support for protecting citizens' personal information security and property rights.

[0043] Example 1:

[0044] like Figure 1 The method for detecting telecom fraud websites based on growth-based incremental learning, as shown, includes the following steps:

[0045] Step 1: Convert the data of telecom fraud websites into a graph structure representation based on the Sentence Transformer model;

[0046] With the increasing diversification and complexity of telecommunications fraud websites, accurate identification of different types of fraudulent websites has become particularly important. Existing malicious website detection methods mostly focus on phishing website detection, i.e., determining whether a website is legitimate or a phishing site. However, phishing websites, as a type of current fraudulent website, exhibit different behavioral patterns than other fraudulent websites, making it difficult for existing malicious website detection methods to accurately identify different types of fraudulent websites. To address this issue, this patent proposes a method for learning graph features of fraudulent websites. First, the Sentence Transformer model is used to extract the semantic features of the URL and webpage content of fraudulent websites, and these features are integrated with WHOIS features to obtain fused features. Next, a graph structure representation of these fused features is constructed. This approach can more accurately reconstruct the feature profile of fraudulent websites, thereby effectively identifying different types of fraudulent websites. The graph structure representation of a telecommunications fraudulent website is as follows: Figure 1 As shown, the specific process includes the following steps:

[0047] Step 1.1: Use web crawling technology to obtain the URLs, webpage content, and WHOIS information of telecom fraud websites;

[0048] Like legitimate websites, fraudulent websites possess URLs, webpage content, and WHOIS information. However, analysis reveals that fraudulent websites either use URLs highly similar to legitimate ones to mislead users, or exhibit obvious anomalies, such as "www.zihu.com" or "http: / / www.nw99999.com". Their webpage content often focuses on high-risk scenarios like financial management and e-commerce shopping. Furthermore, the WHOIS information of fraudulent websites typically indicates they are located in regions with weaker legal jurisdictions, are generally registered for less than six months, and are often less complete than legitimate websites (i.e., have significantly fewer non-empty key-value pairs). Therefore, this invention primarily analyzes fraudulent websites from three aspects: URL, webpage content, and WHOIS information.

[0049] For telecommunications fraud websites, this invention utilizes Python web scraping technology to obtain webpage content. First, the `get` method from the `Requests` library is used to send an HTTP GET request to the web server pointed to by the URL, retrieving the entire HTTP webpage content. Then, the `get_text` method from the `BeautifulSoup` library is used to extract the plain text content of the HTTP webpage. The extracted webpage content is then cleaned to obtain the final webpage content. For WHOIS information, this invention sends a query request to the WHOIS server to obtain the domain's registration time, location information, and the completeness of the WHOIS information.

[0050] Step 1.2: Represent the URL and webpage content based on the Sentence Transformer model to obtain website semantic features; perform feature mapping on WHOIS information to obtain WHOIS features; and fuse the website semantic features and WHOIS features.

[0051] This invention first inputs the URL and webpage content of a fraudulent website into a Sentence Transformer model in the form of "URL + [SEP] + webpage content" to learn the semantic relationship between the two and obtain the website's semantic features. For WHOIS information, this patent determines whether the domain registration time exceeds 6 months, whether the location is in a region with weak judicial supervision, and the number of non-empty key-value pairs in the WHOIS information, mapping these to a 3D feature vector to obtain WHOIS features. Then, feature concatenation is used to fuse the website's semantic features with the WHOIS features. This fused feature can more accurately reconstruct the characteristic profile of the fraudulent website.

[0052] Step 1.3: Construct a graph structure representation of the fusion features.

[0053] This patent represents each fraudulent website as a node, using its fused features as node features. Then, the cosine similarity of the node features between any two nodes is calculated as a measure of the association between them. For each node, the 10 nodes with the highest similarity are selected as its neighbors, constructing a first-order edge relationship; further, the same process is performed on its neighboring nodes to obtain a second-order edge relationship. In this way, discrete fraudulent websites are constructed into a graph structure with inherent relationships, thereby effectively identifying different types of fraudulent websites.

[0054] Step 2: Construct a GAT graph feature extraction model and use this model to learn the graph features of telecom fraud websites;

[0055] The core of the GAT graph feature extraction model constructed in this patent consists of two graph attention convolutional layers. These two convolutional layers sequentially delve into the graph structure representation of telecom fraud websites, learning the graph structure topological relationships between different types of fraudulent websites. Traditional detection methods often identify phishing websites by analyzing URLs or WHOIS structures, such as counting the number of special characters. However, these methods are difficult to adapt to detection scenarios with complex and diverse domain names and numerous types of fraud. Through the GAT graph feature extraction model, this patent can learn and model the graph topological structure of different types of fraudulent websites, thereby achieving accurate identification of diverse fraudulent websites.

[0056] Step 3: For the current incremental task, use the growth-based incremental learning method to enable the graph feature extraction model to perform incremental learning; use the trained graph feature extraction model to test new types of telecom fraud websites.

[0057] In practical applications, telecom fraud websites constantly evolve new types of fraud to evade existing detection models and cater to social hotspots, posing a significant challenge to continuous detection. Retraining the detection model by mixing old and new data incurs substantial computational and time costs, failing to meet the rapid response requirements of real-world applications. Incremental learning has emerged to address this, enabling continuous learning from new data or even just a small amount of old data. However, this process inevitably leads to catastrophic forgetting, limiting its direct application in real-world scenarios. Therefore, this patent combines a growth-based incremental learning method to achieve continuous detection of new fraudulent websites and mitigate the catastrophic forgetting problem. Figure 2 As shown, assume that the training of the first t-1 incremental tasks in the fraudulent website dataset has been completed ( The training of the t-th incremental task specifically includes the following process:

[0058] Step 3.1: Construct the GAT graph feature extraction model for the current task and initialize its parameters; construct the GAT graph feature extraction model corresponding to the current task. and using the previous incremental task model The parameters are initialized for it.

[0059] Step 3.2: Calculate the cross-entropy loss L1 between the prediction results of the GAT graph feature extraction model and the true classification labels;

[0060] This invention will use the current incremental task Samples and replay samples of old tasks Simultaneously input the current task model The model trained on the previous t-1 old tasks (Parameters frozen)

[0061] For each training sample ,Will Prediction results ( ), and all old task models The prediction results { Feature concatenation is performed to obtain the predicted fusion features. The classification cross-entropy loss L1 is calculated using classifier H and true classification labels.

[0062] Step 3.3: Calculate the weight coefficients of the input samples based on the gradient information of the L1 cross-entropy loss;

[0063] For each training sample The gradient information of its classification cross-entropy loss L1 It can be expressed as =H( )-1, if the sample is an old task o( The replay samples, both Then its weighting coefficient is / K; If the sample belongs to a new task, then... Then its weighting coefficient is / The design of this weighting coefficient takes into account both the prediction performance of each sample and the number of samples for each incremental task, giving greater attention to tasks that are difficult to predict or have scarce samples, thereby alleviating the problem of data imbalance.

[0064] Step 3.4: Calculate the migration loss L2 between the prediction results of the current task model and the prediction results of the old task model, and adjust L2 using weighting coefficients;

[0065] In each training sample Its input to At the same time, it is also input into all old task models. In the middle; if the sample is an old task o( The replay samples, both Then obtain the GAT graph feature extraction model trained on the old task o. Output ( ) is used as the distillation vector for this sample; if this sample belongs to a new task, i.e. Then obtain all old task models. The prediction results { } and take the average. This serves as the distillation vector for the sample. Next, the sample... exist Prediction results ( The KL divergence of the vector and its distillation vector is used to calculate the transfer loss L2; ​​and the weight coefficients are used to dynamically adjust L2. In this way, the present invention can better balance the learning of new and old tasks in the incremental learning process, avoid overfitting to general features, and alleviate the catastrophic forgetting problem of old tasks in the incremental training process.

[0066] Step 3.5: Combine the classification cross-entropy loss L1 and the transfer loss L2 to optimize the GAT graph feature extraction model for the current task;

[0067] For all old task models This invention freezes all its parameters to ensure that previously learned knowledge is not overwritten; for the current task model This patent updates the trainable parameters through backpropagation using a combination of L1 and L2 algorithms. Ultimately, this yields an incremental model that combines continuous detection with resistance to forgetting. .

[0068] Step 3.6: Based on the experience replay strategy, save representative samples of the current incremental task for replay in the next incremental learning;

[0069] To mitigate the catastrophic forgetting of old tasks in traditional incremental learning and to train a stable and reliable incremental model, this patent employs an experience replay strategy. This strategy maintains a replay sample set M with a fixed size of K. Each time new data is added, the replay data in the set is updated. The specific update strategy is as follows:

[0070] In the current incremental task After training, calculate the current incremental task. The mean vector of all samples; calculate the mean vector and... The Euclidean distance of all samples; randomly retain K / t replay samples from the first t-1 old tasks in the replay sample set, and delete the rest; from the current incremental task In the sample set, select the K / t samples with the smallest Euclidean distance from the mean vector and add them to the replay sample set M.

[0071] The dataset of telecom fraud websites used in this experiment was independently constructed by this invention, collecting 11,104 URLs from 7 types of websites, and dividing them into training and test sets in a 4:1 ratio. These 7 website types include legitimate websites, investment fraud, romance fraud, online loan fraud, phishing fraud, shopping fraud, and impersonation of law enforcement / prosecutor fraud. Detailed statistical information and the division of incremental learning tasks are shown in Table 1.

[0072] Table 1: Detailed statistics and incremental learning task division of the telecom fraud website dataset.

[0073]

[0074] Based on this, to verify the accurate identification capability of the proposed telecom fraud website detection model based on dynamic dual-optimization incremental learning (hereinafter referred to as the "proposed model") for different types of telecom fraud websites, this invention uses a test set to verify its performance. Experimental evaluation metrics include mean accuracy (mACC) and backtransfer (BWT): mACC measures the model's average performance across all previous learning tasks, with higher values ​​indicating better detection performance; BWT evaluates the impact of learning a new task on the performance of previous learning tasks, with lower values ​​indicating a stronger ability to mitigate catastrophic forgetting. Experimental results show that the proposed model achieves 84.9% and 9.6% accuracy on mACC and BWT, respectively. Simultaneously, a heatmap of the confusion matrix of the test set detection results (e.g., ...) is also provided. Figure 3 As shown in the figure, the proposed model performs well in classifying all types of telecom fraud websites, validating its ability to effectively learn new tasks without forgetting old ones. Furthermore, the T-SNE visualization distribution of the feature vectors on the test set (as shown in the figure) demonstrates that the proposed model achieves good classification results across all types of telecom fraud websites. Figure 4 As shown in the figure, the proposed model can effectively distinguish between different types of telecom fraud websites. In summary, the proposed model can accurately identify different types of telecom fraud websites and has the ability to continuously learn new types of telecom fraud websites.

Claims

1. A method for detecting telecommunications fraud websites based on growth-based incremental learning, characterized in that, Includes the following steps: Step 1: Convert the data of telecom fraud websites into a graph structure representation based on the Sentence Transformer model; Step 2: Construct the GAT graph feature extraction model; train the GAT graph feature extraction model using the graph structure representation to learn the graph features of telecom fraud websites; Step 3: Based on the growth-based incremental learning method, the GAT graph feature extraction model is incrementally learned for the current incremental task; the trained GAT graph feature extraction model is used to extract features of new types of telecom fraud websites and detect new types of telecom fraud websites.

2. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 1, characterized in that, Step 1 includes: Step 1.1: Use web crawling technology to obtain the URLs, webpage content, and WHOIS information of telecom fraud websites; Step 1.2: Represent the URL and webpage content based on the Sentence Transformer model to obtain website semantic features; perform feature mapping on WHOIS information to obtain WHOIS features; perform feature fusion on the website semantic features and the WHOIS features to generate fused features; Step 1.3: Construct the graph structure representation based on the fusion features.

3. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 2, characterized in that, In step 1.2, for the URL and webpage content of the telecom fraud website, a Sentence Transformer model with pre-trained weights of "paraphrase-multilingual-MiniLM-L12-v2" is used to extract the semantic features of the website. For the WHOIS information of the telecom fraud website, feature mapping is performed based on the following three aspects: whether the domain name registration time exceeds 6 months, whether the location is located in an area with weak judicial supervision, and the completeness of the WHOIS information. Based on this, a 3-dimensional feature vector is constructed as the WHOIS feature. The website semantic features and the WHOIS features are fused through feature concatenation.

4. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 2, characterized in that, In step 1.3, in the graph structure representation, each fraudulent website is represented as a node, and its fusion feature is used as the node feature. Calculate the cosine similarity between any two nodes as a correlation metric between nodes; construct the edges of the graph based on the correlation metric to finally obtain the graph structure representation of the telecommunications fraud website data.

5. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 1, characterized in that, Step 3 includes: Step 3.1: Construct the GAT graph feature extraction model for the current task and initialize its parameters; Step 3.2: Calculate the classification cross-entropy loss L1 between the prediction result of the GAT graph feature extraction model for the current task and the true classification label; Step 3.3: Calculate the weight coefficients of the input samples based on the gradient information of the classification cross-entropy loss L1; Step 3.4: Calculate the migration loss L2 between the prediction result of the current task model and the prediction result of the previous incremental task GAT graph feature extraction model, and adjust the migration loss L2 using the weight coefficients. Step 3.5: Combine the classification cross-entropy loss L1 and the transfer loss L2 to optimize the GAT graph feature extraction model for the current task; Step 3.6: Based on the experience replay strategy, select and store representative samples of the current incremental task for replay in subsequent incremental learning.

6. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 5, characterized in that, In step 3.1, the GAT graph feature extraction model from the previous incremental task is used. The model parameters for the GAT graph feature extraction model for the current task Perform initialization.

7. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 6, characterized in that, Step 3.2 includes: The current incremental task The sample and the replay sample of the previous incremental task Simultaneously input the GAT graph feature extraction model of the current task. The model trained on the previous t-1 old tasks middle; The GAT graph feature extraction model for the current task The output, compared with the model trained on the previous t-1 old tasks. The output is concatenated to obtain the predicted fusion features, and the classification cross-entropy loss L1 is calculated by using the classifier and the true classification label.

8. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 7, characterized in that, Step 3.3 includes: Calculate the gradient information of each input sample in the classification cross-entropy loss L1, and calculate its weight coefficient in combination with the number of samples in the task to which the sample belongs.

9. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 8, characterized in that, Step 3.4 includes: Calculate the GAT graph feature extraction model for the current task. The output of the model trained on the previous t-1 old tasks The KL divergence between the outputs is used as the migration loss L2, and the migration loss L2 is weighted and adjusted using the weighting coefficients.

10. The method for detecting telecommunications fraud websites based on growth-based incremental learning according to claim 9, characterized in that, Step 3.6 includes: In the current incremental task After training, calculate the current incremental task. The mean vector of all samples; calculate the mean vector and... The Euclidean distance of all samples; randomly retain K / t replay samples from the first t-1 old tasks in the replay sample set, and delete the remaining samples; from the current incremental task From the sample set, select K / t samples with the smallest Euclidean distance from the mean vector and add them to the replay sample set M.

Images