A site risk identification rule processing method, device and equipment

Abstract

The embodiment of the specification discloses a kind of station risk identification rule processing method, device and equipment, the method comprises: obtaining the site information of target network site to be identified;Based on the preset site identification demand information, corresponding prompt information is constructed, based on prompt information, using first large language model, generate first risk identification rule for target site based on site information;The first risk identification rule is extended and handled, and the rule population for target site is obtained;Each rule in the rule population is evaluated by a plurality of different modes by a preset multi-modal large model, to obtain the evaluation result of rule population;Based on the evaluation result of rule population, the rule population is iteratively optimized by difference evolution algorithm, to obtain the optimized rule population, based on the optimized rule population, determine the risk identification rule for target site.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a method, apparatus, and equipment for processing risk identification rules for a site. Background Technology

[0002] With the continuous development and popularization of internet technology, the number of risky websites (including fraudulent, phishing, privacy data leakage, illegal sales, and illegal content dissemination websites) is enormous and diverse, exhibiting the following typical characteristics: Strong dynamic camouflage: These risky websites frequently change domain names and page layouts to evade detection based on keywords and URL blacklists; High visual deception: They extensively imitate the visual style of legitimate websites, making accurate identification difficult based solely on URLs or HTML text; Massive scale: Tens of thousands of new risk points are added daily, making manual review inefficient and extremely costly; Semantic diversity: Different types of risky websites use vastly different text and image styles, making it difficult for a single rule to cover them all. Therefore, a better risk identification rule construction mechanism is needed. Summary of the Invention

[0003] The purpose of the embodiments in this specification is to provide a better risk identification rule construction mechanism.

[0004] To achieve the above technical solution, the embodiments in this specification are implemented as follows: This specification provides an embodiment of a method for processing risk identification rules for a website. The method includes: acquiring site information of a target website to be identified, the site information including one or more of the following: text content information, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; constructing corresponding prompt information based on preset site identification requirements; generating a first risk identification rule for the target website based on the prompt information using a first large language model; expanding the first risk identification rule to obtain a rule population for the target website; evaluating each rule in the rule population using multiple different modalities through a preset multimodal large model to obtain an evaluation result for the rule population; iteratively optimizing the rule population using a differential evolution algorithm based on the evaluation result to obtain an optimized rule population; and determining a risk identification rule for the target website based on the optimized rule population.

[0005] This specification provides an embodiment of a device for processing risk identification rules for a website. The device includes: an information acquisition module, which acquires website information of a target website to be identified, the website information including one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and website risk audit results; a rule generation module, which constructs corresponding prompt information based on preset website identification requirements, and generates a first risk identification rule for the target website based on the website information using a first large language model; a rule expansion module, which expands the first risk identification rule to obtain a rule population for the target website, and evaluates each rule in the rule population using multiple different modalities through a preset multimodal large model to obtain an evaluation result for the rule population; and an iterative optimization module, which iteratively optimizes the rule population using a differential evolution algorithm based on the evaluation result of the rule population to obtain an optimized rule population, and determines a risk identification rule for the target website based on the optimized rule population.

[0006] This specification provides an embodiment of a site risk identification rule processing device, comprising: a processor; and a memory arranged to store computer-executable instructions, wherein the executable instructions, when executed, cause the processor to: acquire site information of a target website to be identified, the site information including one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; construct corresponding prompt information based on preset site identification requirement information; based on the prompt information, generate a first risk identification rule for the target website using a first large language model; extend the first risk identification rule to obtain a rule population for the target website; evaluate each rule in the rule population using multiple different modalities through a preset multimodal large model to obtain an evaluation result for the rule population; iteratively optimize the rule population using a differential evolution algorithm based on the evaluation result of the rule population to obtain an optimized rule population; and determine the risk identification rule for the target website based on the optimized rule population.

[0007] This specification also provides a storage medium for storing computer-executable instructions. When executed by a processor, these instructions implement the following process: acquiring site information of a target website to be identified, including one or more of the following: text content information, webpage screenshots, webpage structure information, URL information, historical tag information, and site risk assessment results; constructing corresponding prompt information based on preset site identification requirements; generating a first risk identification rule for the target website based on the prompt information using a first large language model; expanding the first risk identification rule to obtain a rule population for the target website; evaluating each rule in the rule population using multiple different modalities through a preset multimodal large model to obtain an evaluation result for the rule population; iteratively optimizing the rule population using a differential evolution algorithm based on the evaluation result to obtain an optimized rule population; and determining a risk identification rule for the target website based on the optimized rule population.

[0008] This specification also provides a computer program product, including a computer program that, when executed by a processor, implements the following process: acquiring site information of a target website to be identified, the site information including one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; constructing corresponding prompt information based on preset site identification requirements; generating a first risk identification rule for the target website based on the prompt information using a first large language model; expanding the first risk identification rule to obtain a rule population for the target website; evaluating each rule in the rule population using multiple different modalities through a preset multimodal large model to obtain an evaluation result for the rule population; iteratively optimizing the rule population using a differential evolution algorithm based on the evaluation result of the rule population to obtain an optimized rule population; and determining a risk identification rule for the target website based on the optimized rule population. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Figure 1 This is a schematic diagram of the structure of a risk identification rule processing system for a site, as described in this specification. Figure 2 This is a schematic diagram illustrating the processing procedure of a risk identification rule for a site as described in this specification; Figure 3 This is a schematic diagram illustrating the processing procedure of risk identification rules at another site described in this manual; Figure 4 This is a schematic diagram illustrating the processing procedure of another type of site risk identification rule in this specification; Figure 5 This is a schematic diagram illustrating the processing procedure of another type of site risk identification rule in this specification; Figure 6 This is a schematic diagram illustrating the processing procedure of another type of site risk identification rule in this specification; Figure 7 This is a schematic diagram illustrating the processing procedure of another type of site risk identification rule in this specification; Figure 8 This is a schematic diagram of a device for processing risk identification rules at a site, as described in this specification. Figure 9 This is a schematic diagram of a device for processing risk identification rules at a site, as described in this specification. Detailed Implementation

[0010] This specification provides a method, apparatus, and device for processing risk identification rules for a site.

[0011] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0012] This specification provides a website risk identification rule processing mechanism based on large-scale model rule generation and differential evolution optimization. With the continuous development and popularization of Internet technology, the number of risky websites (including fraudulent, phishing, illegal sales, and illegal content dissemination websites) is huge and diverse, with the following typical characteristics: strong dynamic camouflage: the above-mentioned risky websites frequently change domain names and page layouts to evade detection based on keywords and URL blacklists; high visual deception: they imitate the visual style of legitimate websites in large numbers, making it difficult to accurately identify them based on URLs or HTML text alone; huge scale: tens of thousands of new risk points are added every day, making manual review inefficient and extremely costly; semantic diversity: different types of risky websites use vastly different text and image styles, making it difficult for a single rule to cover them.

[0013] To address the typical characteristics of risky websites, risk identification rules can be constructed based on keywords or regular expressions. Specifically, security experts manually compile lists of keywords, regular expressions, or URL patterns to build risk identification rules for websites, thereby matching and identifying the text content or URLs of the websites. However, this method has several drawbacks: low coverage (manual rules cannot exhaustively cover all variations of risky website expressions, resulting in numerous missed detections); high maintenance costs (risky websites are constantly changing, requiring frequent manual updates to risk identification rules, consuming significant expert time); high false positive rate (keyword matching lacks contextual understanding, and normal websites may be misjudged due to the presence of specific words); poor generalization ability (rules written for specific types of risky websites cannot adapt to new risk patterns); and lack of multimodal capabilities (relying solely on textual information and ignoring visual features of the page).

[0014] In addition, risk identification rules can be built based on machine learning classification models. Specifically, classification models such as CNN and BERT are trained, and data such as URLs, HTML text, or screenshot features of specified websites are input, with the output data being the risk classification results. However, this method relies on a large amount of labeled data: it requires massive amounts of high-quality labeled samples, and the data collection and labeling costs are high; it has poor interpretability: the model's decision-making is black-box, and it cannot output understandable and auditable judgment criteria (or judgment rules) to the business side; its generalization ability is limited: its performance drops significantly on new risk sites outside the training set distribution; and it has slow update and iteration: new risk categories require new data collection, labeling, and training, which takes a long time.

[0015] Alternatively, risk identification rules can be built based on blacklists and reputation databases. Specifically, this involves maintaining blacklists of known risky sites' URLs, domains, and IP addresses, and blocking websites that match these lists. However, this method suffers from poor timeliness: blacklist updates are delayed, and newly registered risky sites cannot be blocked before being added to the blacklist; bypassing the blacklist is extremely costly: simply changing the domain name can circumvent detection; it cannot identify risk variants: it lacks the ability to identify imitation sites and mirror sites; and maintenance costs are high: the blacklist is massive, making data governance difficult.

[0016] In addition, risk identification rules can be based on pure large language model LLM. Specifically, the large language model LLM can be directly called, with task description information as input data, to generate risk identification rules. However, this method lacks feedback optimization: after LLM generates risk identification rules, there is no verification and iteration based on actual data, so the quality of risk identification rules cannot be guaranteed; it cannot automatically adapt to difficult samples: for hard samples with ambiguous classification boundaries, a single generation cannot be optimized specifically; the output is unstable: LLM generation is random, and the quality of multiple outputs is inconsistent; it lacks multimodal evaluation: pure text rule generation ignores site image information. Therefore, a better risk identification rule construction mechanism is needed. In the embodiments of this specification, the semantic generation capability of large language model and the multimodal evaluation capability of multimodal large model are combined with differential evolution algorithm to realize the automatic generation, automatic evaluation and automatic optimization of risk identification rules for network sites, solving the core pain points of low efficiency, low coverage and high maintenance cost of manual rule writing. For specific processing, please refer to the specific content of the following embodiments.

[0017] The method for processing site risk identification rules provided in one or more embodiments of this specification is applicable to the implementation environment of processing site risk identification rules. (Refer to...) Figure 1 The implementation environment includes at least: Client 100 and server 200. Furthermore, server 200 may include a primary language model, a multimodal large model, etc., among which: Client 100 can run on terminal devices, which can be mobile phones, personal computers, tablets, e-book readers, wearable devices, devices that interact with information based on AR (Augmented Reality) and VR (Virtual Reality), and laptop computers, etc. Client 100 can be installed on terminal devices. Client 100 can be an application, a browser, or a subroutine embedded in an application, etc.

[0018] Server 200 can run on a server, which can be one or more servers, a server cluster consisting of several servers, or a cloud server on a cloud computing platform. Server 200 can be installed on the server. Server 200 can be an application or a subroutine embedded in an application. The first large language model, multimodal large model, etc., can be integrated into server 200. Alternatively, server 200 can call any one or more of the first large language model, multimodal large model, etc., to perform corresponding operations.

[0019] In addition, it may include a database 300, which may be set in the server on which the server 200 runs, or it may be set outside the server on which the server 200 runs. The database 300 may store site information and risk identification rules and other related information.

[0020] In this implementation environment, client 100 can obtain site information of the target website to be identified. This site information includes one or more of the following: text content information of the target website, webpage screenshots, webpage structure information, URL information, historical tag information, and site risk assessment results. Then, client 100 can provide the obtained site information of the target website to server 200. Server 200 can construct corresponding prompt information based on preset site identification requirements. Based on the prompt information, using a first large language model, a first risk identification rule for the target website is generated based on the site information. Subsequently, the first risk identification rule can be extended to obtain a rule population for the target website. Each rule in the rule population is evaluated in multiple different modalities using a preset multimodal large model to obtain the evaluation result of the rule population. Based on the evaluation result of the rule population, the rule population is iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, the risk identification rule for the target website is determined.

[0021] like Figure 2 As shown in the embodiments of this specification, a method for processing risk identification rules for a website is provided. The execution subject of this method can be a terminal device or a server, etc. The terminal device can be a mobile terminal device such as a mobile phone or tablet computer, a computer device such as a laptop or desktop computer, or an IoT device (specifically, a smartwatch, in-vehicle device, etc.). The server can be a single server or a server cluster composed of multiple servers. The server can be a backend server in fields such as finance or online shopping, or a backend server of an application. This embodiment uses a server as the execution subject for detailed explanation. For the case where the execution subject is a terminal device, please refer to the following server-side processing, which will not be repeated here. The method may specifically include the following steps: In step S202, the site information of the target website to be identified is obtained. The site information includes one or more of the following: text content information of the target website, webpage screenshot, webpage page structure information, URL information, historical tag information, and site risk audit results.

[0022] The target website can be a single website or multiple different websites. In practical applications, target websites can include those with pre-existing risks, such as those engaged in illegal or risky activities like fraud, phishing, illegal sales, or the dissemination of illegal content. Specifically, this includes websites involved in advertising, content moderation, domain name detection, and app market scenarios. Websites with pre-existing risks are typically highly deceptive and dynamically changing. Each website can also include one or more different web pages, each containing text content, page structure information, and URL information. The text content of the target website can be the text content of each web page within the target website. Web page screenshots can be screenshots of each web page within the target website. The page structure information can include page layout information, page color information, and content hierarchy. Historical tag information can be tags set for the target website before the current moment, indicating whether the target website has pre-existing risks. The site risk audit result can be the result of a risk audit of the target website to determine whether it has pre-existing risks, indicating whether the target website has pre-existing risks.

[0023] In implementation, site information of the target websites to be identified can be obtained in various ways. For example, site information of one or more target websites can be obtained from a specified database or dataset. Alternatively, a certain number of target websites can be crawled from the Internet using a web crawler, which may include site information of target websites with preset risks. Or, a certain number of websites can be selected from target websites with preset risks recorded in a specified business system to obtain the target websites. The specific settings can be configured according to the actual situation.

[0024] In step S204, corresponding prompt information is constructed based on preset site identification requirement information. Based on the prompt information, the first major language model is used to generate a first risk identification rule for the target site based on the above site information.

[0025] The prompts can be prompt words applied to the large model, or text input into the large model to guide it in generating the required output. Prompts can be a question, an instruction, or a piece of context to help the large model better understand and respond to various queries. Prompts can include explicit instruction-type prompts, context-supplementary prompts, and example-guided prompts, providing detailed background information and examples to help the large model generate more relevant and accurate output. The first large language model can be a natural language processing model composed of hundreds of millions of parameters, based on deep learning algorithms and pre-trained using a large-scale corpus, performing text understanding, generation, and conversion. The first large language model can include Qwen3-32B, GPT-4, ERNIE Bot, etc., and the specific model can be set according to the actual situation.

[0026] In implementation, the model architecture of the first major language model can be pre-constructed according to the actual situation. Then, a large amount of sample data can be obtained (including prompt information samples and site information of specified websites, as well as corresponding tag information (i.e., corresponding risk identification rules)). The first major language model can be trained using the sample data to obtain the trained first major language model. Alternatively, a pre-trained major language model can be used as the first major language model. A large amount of sample data can be obtained, and the first major language model can be fine-tuned using the sample data to obtain the fine-tuned first major language model. Alternatively, the first major language model that can generate risk identification rules can be directly obtained, etc. The specific settings can be determined according to the actual situation.

[0027] Task prompts can be pre-built to define identification targets, such as "identify xx referral sites," "identify fake download sites," and "identify fraudulent financial websites." This allows for the determination of site identification requirements, specifically, identifying fake download sites. Furthermore, prompt templates can be pre-built, which may include commonly used settings or information, default settings or information, and information to be filled in, depending on the specific situation. The site identification requirements can be used to fill in the information to be filled in the prompt template to generate complete prompts. These prompts can then be input into a primary language model, guiding it to determine the relevant characteristics of risky sites based on the aforementioned site information. These characteristics include domain name features, text content features (such as keywords and special characters), image features, and page structure features. Based on these characteristics, a primary risk identification rule can be generated for the target site.

[0028] In step S206, the first risk identification rule is extended to obtain a rule population for the target site. Each rule in the rule population is evaluated in multiple different modes using a preset multimodal large model to obtain the evaluation result of the rule population.

[0029] The rules in the rule population serve as descriptive textual criteria for determining whether a target website is a risky site, and can include multi-dimensional conditions such as visual features, textual features, and semantic features. The rule population itself comprises a set of rules, where each rule represents a rule scheme or a set of rule schemes. The multimodal large-scale model can consist of hundreds of millions of parameters, based on deep learning algorithms, and pre-trained using large-scale multimodal corpora to perform multimodal data understanding, generation, and conversion of text, images, and other data. The multimodal large-scale model can include Qwen2.5-VL-72B, Gemini-3-Pro, etc., and the specific model can be configured according to actual needs.

[0030] In implementation, to further increase the number of rules, various extended rules can be pre-defined, such as keyword replacement-based extended rules and data pruning-based extended rules. Specifically, the first risk identification rule can be extended using keyword replacement-based extended rules, replacing specified keywords with pre-defined words to form a new risk identification rule. Furthermore, the first risk identification rule can be extended using various other extended rules, ultimately resulting in a rule population targeting the target site. Afterward, relevant information can be obtained to generate corresponding prompts. These prompts can be input into a multimodal large-scale model, guiding the model to evaluate each rule in the rule population based on webpage screenshots, text content, and rule definitions. This evaluation assesses the performance of each rule in the rule population regarding classification results, confidence levels, and the reasons for classification results, ultimately yielding the evaluation result for the rule population.

[0031] In step S208, based on the evaluation results of the rule population, the rule population is iteratively optimized using the differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined.

[0032] Differential Evolution (DE) is an evolutionary algorithm known for its fast convergence speed and high accuracy. It is considered a highly efficient global optimizer, and under the same conditions, its convergence speed and accuracy are superior to genetic algorithms and particle swarm optimization. The DE algorithm's operation involves parameter initialization, population initialization, population mutation, population crossover, and selection of the best rule. Several parameters are crucial during initialization, such as mutation parameters, crossover probability, population size, and the dimension of each rule. After initializing the population, mutation is performed to generate mutation vectors. To generate diverse offspring vectors and enhance the diversity and complexity of the rule population, crossover is performed. Finally, a greedy selection operation is executed to choose the best rule from among the rule population's offspring.

[0033] In implementation, based on the evaluation results of the rule population described above, the specific processing steps of the differential evolution algorithm can be used to iteratively optimize the rule population, resulting in an optimized rule population. The optimized rule population can be used as the risk identification rule for the target site. Alternatively, a selection rule can be pre-defined, and the selected rules can be used as the risk identification rule for the target site. The specific rules can be set according to the actual situation.

[0034] This specification provides a method for processing risk identification rules for a website. The method involves acquiring site information of the target website to be identified, including one or more of the following: text content, webpage screenshots, page structure information, URL information, historical tag information, and site risk audit results. Then, based on preset site identification requirements, corresponding prompts can be constructed. Based on these prompts, a first large language model is used to generate a first risk identification rule for the target website. Subsequently, the first risk identification rule can be expanded to obtain a rule population for the target website. Each rule in this rule population is then processed using a preset multimodal large language model. The evaluation results of the rule population are obtained through evaluations of different modalities. Finally, based on the evaluation results of the rule population, the rule population can be iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined. In this way, the initial rules are automatically generated by the first large language model and automatically iteratively optimized by the differential evolution algorithm. This not only significantly reduces the cost and efficiency of writing and updating rules, but also improves convergence efficiency and optimization quality. Moreover, the introduction of a multimodal large model to jointly evaluate text, page screenshots, button layouts, and image copywriting improves the identification effect of fake pages, image copywriting, and brand counterfeit pages, thereby improving the accuracy of risk identification.

[0035] In practical applications, the specific processing method for constructing corresponding prompt information based on preset site identification requirement information in step S204 can vary. The following provides another optional processing method, which may specifically include the processing steps S2042 and S2044. Based on this, in the above... Figure 2 Based on this, the specific steps included in this method can be as follows: Figure 3 As shown.

[0036] In step S2042, rule generation requirement information and preset site identification requirement information are obtained. The rule generation requirement information includes one or more of the following: rule generation format, rule generation dimension, and constraint conditions. The site identification requirement information includes the types of risks that need to be identified.

[0037] The constraints can be those that the generated rules must follow, or those that the rules to be generated must include; the specifics can be set according to the actual situation. Risk types can include various categories, such as fraud, fake download sites, and risky referral sites; the specifics can be set according to the actual situation.

[0038] During implementation, technicians can input rule generation requirements and site identification requirements based on actual needs. After inputting the information, they can send it to the server through the technician's terminal device. The server can then obtain the rule generation requirements and site identification requirements.

[0039] In step S2044, corresponding prompt information is constructed based on rule-generated requirement information and preset site identification requirement information.

[0040] In implementation, a prompt message template can be pre-built. This prompt message template can include commonly used settings or information, default settings or information, and information to be filled in. Then, the required information and preset site identification requirements can be generated by using rules to fill in the information to be filled in the prompt message template to generate a complete prompt message.

[0041] In practical applications, the first risk identification rule includes one or more of the following: page text trigger conditions, visual layout features, preset types of buttons, graphic codes, download guidance features, semantic patterns of brand counterfeiting, semantic patterns of inducing sharing, semantic patterns of customer service referrals, and risk assessment and decision-making logic.

[0042] The preset button types can include various options, such as red buttons or high-risk buttons with specified risky content, which can be set according to the actual situation. Visual layout features can include various options, such as color layout features, layout features at different levels, and layout features for different page elements (such as buttons, images, text, input boxes, videos, etc.), which can be set according to the actual situation. Graphic codes can include barcodes, QR codes, etc., which can be set according to the actual situation.

[0043] In practical applications, the specific processing method for extending the first risk identification rule in step S206 above to obtain the rule population for the target site can vary. Here is another optional processing method, which may include the following: extending the first risk identification rule based on a preset extension rule to generate multiple different candidate risk identification rules; determining the rule population for the target site based on these multiple different candidate risk identification rules, wherein the different candidate risk identification rules differ in at least one of the following dimensions: Differences in preset keyword combinations; Risk weight differences; Differences in conditional connection methods; Fuzzy description of granularity differences; Differences in the priority of visual cues.

[0044] In practical applications, the specific processing methods for evaluating each rule in the rule population using multiple different modalities through a preset multimodal large model in step S206 to obtain the evaluation results of the rule population can be varied. The following provides another optional processing method, which may specifically include the processing steps S2062 and S2064. Based on this, in the above... Figure 2 Based on this, the specific steps included in this method can be as follows: Figure 4 As shown.

[0045] In step S2062, a verification dataset is obtained. The verification dataset includes one or more of the following: text content information from multiple different sites, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results.

[0046] In step S2064, corresponding first prompt information is constructed based on the preset target recognition requirement information. Based on the first prompt information, a multimodal large model is used to evaluate each rule in the rule population in multiple different modalities on the validation dataset to obtain the evaluation result of the rule population. The evaluation result of the rule population includes one or more of the following: the risk identification result corresponding to the validation dataset, the confidence level of the risk identification result corresponding to the validation dataset, the reasoning chain of the risk identification result corresponding to the validation dataset, the analysis information of the validation data samples with incorrect risk identification results in the validation dataset, and the rule applicability evaluation result.

[0047] The first prompt can be a prompt word applied to the multimodal large model. The first prompt can be information input into the multimodal large model to guide it in generating output results that meet the requirements. The first prompt can be a question, an instruction, or a piece of context to help the multimodal large model better understand and respond to various queries. The first prompt can include explicit instruction prompts, context-supplementary prompts, and example-guided prompts. By providing detailed background information and examples, the first prompt helps the multimodal large model generate more relevant and accurate output results.

[0048] In implementation, based on the preset target recognition requirements, corresponding first prompt information is constructed. This first prompt information can be input into the multimodal large model. Through this prompt information, the multimodal large model is guided to evaluate each rule in the rule population on the validation set, in conjunction with webpage screenshots, text content, and rule definitions. This evaluates the performance of each rule in the rule population in terms of risk identification results corresponding to the validation dataset, confidence level of risk identification results corresponding to the validation dataset, reasoning chain of risk identification results corresponding to the validation dataset, analysis information of validation data samples with incorrect risk identification results in the validation dataset, and rule applicability evaluation results. Finally, the evaluation result of the rule population can be obtained.

[0049] In practical applications, the evaluation results of the rule population in step S208 above are used to iteratively optimize the rule population using a differential evolution algorithm. The specific processing methods for obtaining the optimized rule population can vary. The following provides another optional processing method, which may specifically include the processing steps S2082 to S2088. Based on this, in the above... Figure 4 Based on this, the specific steps included in this method can be as follows: Figure 5 As shown.

[0050] In step S2082, based on the evaluation results of the rule population, multiple different second risk identification rules that meet preset conditions are obtained from the rule population.

[0051] The preset conditions can include a variety of conditions. For example, the preset conditions can be that the applicability of the rule is higher than a preset threshold, or that the confidence level of the risk identification results of the verification dataset corresponding to the risk identification rule is higher than a preset confidence threshold. The specific conditions can be set according to the actual situation.

[0052] In step S2084, the differential information between different second risk identification rules is determined, and one second risk identification rule other than the two second risk identification rules corresponding to the differential information is selected from multiple different second risk identification rules. Based on the selected second risk identification rule and the differential information, a variation risk identification rule is generated.

[0053] In implementation, each second risk identification rule can be encoded to obtain the corresponding encoded information, such as... Figure 6As shown, the encoded information can be presented in various ways, such as as a vector or matrix. Taking the encoded information as a vector as an example, the vector difference between the encoded information corresponding to any two second risk identification rules can be calculated to generate a corresponding difference vector, which can be the difference information. Another second risk identification rule (i.e., a second risk identification rule other than the two second risk identification rules corresponding to the difference information) can be selected from multiple different second risk identification rules. The selected second risk identification rule and the difference vector are then summed to generate the variation risk identification rule.

[0054] In step S2086, the mutation risk identification rule and the corresponding second risk identification rule are cross-operated to generate the third risk identification rule.

[0055] In implementation, such as Figure 6 As shown, the variation risk identification rule and the corresponding second risk identification rule can be cross-operated to combine the valid sub-conditions or scoring logic in multiple second risk identification rules, thereby generating the third risk identification rule.

[0056] In step S2088, multiple different second risk identification rules and generated third risk identification rules are evaluated in multiple different modes using a preset multimodal large model to obtain corresponding target evaluation results. Based on the obtained target evaluation results, risk identification rules that meet preset conditions are selected from multiple different second risk identification rules and generated third risk identification rules. Differential evolution algorithm is used for iterative optimization until a preset number of iterations is reached. An optimized rule population is constructed based on the risk identification rules that meet preset conditions selected in each iteration.

[0057] In implementation, such as Figure 6 As shown, based on the pre-set multimodal large model in step S206, each rule in the rule population can be evaluated using multiple different modalities. This can be achieved by evaluating multiple different second risk identification rules and the generated third risk identification rules using the pre-set multimodal large model, obtaining corresponding target evaluation results. Based on the obtained target evaluation results, risk identification rules that meet preset conditions are selected from the multiple different second risk identification rules and the generated third risk identification rules. Then, based on the evaluation results of the rule population in step S208, the rule population is iteratively optimized using a differential evolution algorithm to obtain the optimized rule population. This iterative optimization continues until a preset number of iterations is reached. The optimized rule population is constructed based on the risk identification rules that meet the preset conditions selected in each iteration.

[0058] In practical applications, the evaluation results of rule populations include analytical information from verification data samples with incorrect risk identification results in the verification dataset. Based on this, misjudged samples can be analyzed in the following ways to identify typical confusion scenarios, such as... Figure 6 As shown, please refer to steps A2 and A4 below for details.

[0059] In step A2, based on the analysis information of the verification data samples with incorrect risk identification results in the verification dataset, the misjudgment scenario information corresponding to the verification data samples with incorrect risk identification results is determined. The misjudgment scenario information includes one or more of the following: confusion between normal download pages and induced download pages; confusion between normal customer service pages and fraudulent traffic redirection pages; confusion between legitimate information pages and illegal advertorial pages (or illegal consultation pages, etc.); and confusion between normal e-commerce promotion pages and fake rebate pages.

[0060] Among them, illegal advertorial pages can be pages that illegally contain advertorials. These advertorials can be textual content that obscures the line between advertising and news reporting through covert promotion, misleading readers into believing that paid information is objective content, and ultimately achieving the purpose of brand promotion or product sales.

[0061] In step A4, the misjudged scenario information is provided to the first language model so that the boundary conditions and / or exclusion conditions in the first risk identification rule generated for the target site can be corrected by the first language model.

[0062] In practical applications, it can also be used for hard sample mining, such as... Figure 6 As shown, please refer to steps B2 and B4 below for details.

[0063] In step B2, target data is obtained. The target data includes one or more of the following: a first verification data sample whose confidence level of the risk identification result corresponding to the verification dataset is less than a preset confidence threshold, a second verification data sample whose risk identification result in the verification dataset is incorrect, and a new type of network site with preset risk.

[0064] In step B4, difficult samples for rule evaluation are constructed based on the target data, and the validation dataset is updated based on the difficult samples.

[0065] Through the processing in steps B2 and B4 above, difficult samples can be automatically identified and added to the next round of evaluation, thereby continuously enhancing the robustness of the rules on edge scenarios and novel camouflaged samples.

[0066] In practical applications, based on the above, risk identification rules and other necessary information for the target site can also be output, such as... Figure 6 As shown, please refer to the processing in steps C2 and C4 below.

[0067] In step C2, obtain the evaluation report of each rule in the optimized rule population, the iterative optimization log and hard sample analysis report corresponding to the optimized rule population, and obtain the risk identification rules and / or sub-rules for different risk types in the risk identification rules for the target site. The evaluation report includes one or more of the following: accuracy, recall, false positive rate, and F1 score.

[0068] The iterative optimization log can include the number of iterations, the time of each iteration, and the result of each iteration, which can be set according to the actual situation. The difficult sample analysis report can include the generation time of the difficult sample, the type of the difficult sample, etc., which can be set according to the actual situation. Sub-rules can be sub-rules contained in risk identification rules. Risk identification rules may or may not contain sub-rules. If a risk identification rule contains sub-rules, it can include one sub-rule or multiple different sub-rules, which can be set according to the actual situation.

[0069] In step C4, the output is described. Figure 6 The processing steps shown can enable the creation of risk identification rules, which can then be applied to one or more of the following: internet security risk prevention and control platforms, network security monitoring systems (such as security gateway products that monitor and block risky sites in real time), advertising anti-fraud systems (such as identifying whether the landing page submitted by the advertiser is a risky site to prevent illegal advertising), browser / search engine security mechanisms (such as real-time risk rating of URLs accessed by users), and enterprise-level content security SaaS (thereby providing site compliance testing services for an organization or institution).

[0070] In practical applications, the specific processing method for generating the first risk identification rule for the target site based on the prompt information and the first language model in step S204 above can vary. The following provides another optional processing method, which may specifically include the processing steps S2046 and S2048. Based on this, in the above... Figure 2 Based on this, the specific steps included in this method can be as follows: Figure 7 As shown.

[0071] In step S2046, auxiliary information of the target website is obtained. The auxiliary information includes one or more of the following: graph feature information, filing information, page interaction behavior trajectory, report information, and review feedback information corresponding to the target website.

[0072] The graph feature information can include node feature information and edge feature information. The graph corresponding to the graph feature information can include nodes and edges. Nodes can be constructed from relevant information of the target website, such as one or more of the target website's URL, keywords, screenshots, and related tag information. Edges can represent the relationships between different nodes. The corresponding node feature information can be determined based on the corresponding nodes, and the edge feature information can be determined based on the corresponding edges. The specific settings can be set according to the actual situation.

[0073] In step S2048, based on the prompt information, the first major language model is used to generate a first risk identification rule for the target site based on the site information and auxiliary information.

[0074] In implementation, the information to be filled in the above prompt information template can be generated by identifying the site's requirements. Then, the prompt information can be input into the first language model. The prompt information guides the first language model to determine the relevant characteristics of the risk site based on the above site information and auxiliary information, including its domain name characteristics, text content characteristics (such as keywords, special characters, etc.), image characteristics, page structure characteristics, etc. Based on the relevant characteristics of the risk site, the first risk identification rule for the target site can be summarized and generated.

[0075] In practical applications, risk identification rules for target sites can be deployed into application systems, as detailed in steps D2 to D6 below.

[0076] In step D2, the determined risk identification rules for the target site are deployed to the access services of the target network site.

[0077] In step D4, when an access request for a target website initiated by a target user is received, the identification auxiliary information corresponding to the target website is obtained. The identification auxiliary information includes one or more of the following: graph feature information, filing information, page interaction behavior trajectory, report information, and review feedback information corresponding to the target website.

[0078] In step D6, the access request is processed for risk identification based on the identification auxiliary information and the determined risk identification rules for the target site.

[0079] This specification provides a method for processing risk identification rules for a website. The method involves acquiring site information of the target website to be identified, including one or more of the following: text content, webpage screenshots, page structure information, URL information, historical tag information, and site risk audit results. Then, based on preset site identification requirements, corresponding prompts can be constructed. Based on these prompts, a first large language model is used to generate a first risk identification rule for the target website. Subsequently, the first risk identification rule can be expanded to obtain a rule population for the target website. Each rule in this rule population is then processed using a preset multimodal large language model. The evaluation results of the rule population are obtained through evaluations of different modalities. Finally, based on the evaluation results of the rule population, the rule population can be iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined. In this way, the initial rules are automatically generated by the first large language model and automatically iteratively optimized by the differential evolution algorithm. This not only significantly reduces the cost and efficiency of writing and updating rules, but also improves convergence efficiency and optimization quality. Moreover, the introduction of a multimodal large model to jointly evaluate text, page screenshots, button layouts, and image copywriting improves the identification effect of fake pages, image copywriting, and brand counterfeit pages, thereby improving the accuracy of risk identification.

[0080] Furthermore, the final output includes not only structured identification rules but also relevant report information suitable for auditing, review, strategy linkage, and compliance interpretation. Through difficult sample mining and confusion feedback mechanisms, risk identification rules can be automatically optimized for new variant samples, improving adaptability to rapidly changing scenarios. Additionally, differential evolution algorithms are used for the generation, mutation, crossover, and selection of individual rules, enabling automatic search and optimization at the rule level. Confusion features are extracted from misjudged samples and fed back into the rule generation and optimization process, enhancing the rule boundary identification capability. Moreover, it can automatically discover low-confidence samples and new variant samples, incorporating them into the next round of optimization, improving the system's robustness to unknown risk samples. This forms an integrated closed-loop architecture of "rule generation—evaluation—evolution—feedback," constructing a continuously evolving risk control identification system that differs from single-step model inference and static rule maintenance. While ensuring identification accuracy, it retains the explainable, auditable, and controllable characteristics of rules, making it more suitable for industrial-level risk prevention and control scenarios.

[0081] The above describes the method for processing site risk identification rules provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a device for processing site risk identification rules, such as... Figure 8 As shown.

[0082] The risk identification rule processing device for this site includes: an information acquisition module 801, a rule generation module 802, a rule expansion module 803, and an iterative optimization module 804, wherein: The information acquisition module 801 acquires site information of the target website to be identified. The site information includes one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results. The rule generation module 802 constructs corresponding prompt information based on preset site identification requirement information, and generates a first risk identification rule for the target site based on the site information using a first major language model. The rule extension module 803 extends the first risk identification rule to obtain a rule population for the target site. It then evaluates each rule in the rule population using multiple different modalities through a preset multimodal large model to obtain the evaluation result of the rule population. The iterative optimization module 804, based on the evaluation results of the rule population, iteratively optimizes the rule population using a differential evolution algorithm to obtain an optimized rule population, and determines the risk identification rules for the target site based on the optimized rule population.

[0083] In this embodiment of the specification, the rule generation module 802 includes: The information acquisition unit acquires rule generation requirement information and preset site identification requirement information. The rule generation requirement information includes one or more of rule generation format, rule generation dimension, and constraint conditions. The site identification requirement information includes the types of risks that need to be identified. The prompt information construction unit generates corresponding prompt information based on the rules, the required information, and the preset site identification requirement information.

[0084] In the embodiments of this specification, the first risk identification rule includes one or more of the following: page text triggering conditions, visual layout features, preset type of buttons, graphic codes, download guidance features, semantic patterns of brand counterfeiting, semantic patterns of inducing sharing, semantic patterns of customer service referral, and risk assessment and decision-making logic.

[0085] In this embodiment of the specification, the rule expansion module 803 expands the first risk identification rule based on preset expansion rules to generate multiple different candidate risk identification rules. Based on the multiple different candidate risk identification rules, a rule population for the target site is determined. The different candidate risk identification rules differ in at least one of the following dimensions: Differences in preset keyword combinations; Risk weight differences; Differences in conditional connection methods; Fuzzy description of granularity differences; Differences in the priority of visual cues.

[0086] In this embodiment of the specification, the rule expansion module 803 includes: The verification set acquisition unit acquires a verification dataset, which includes one or more of the following: text content information from multiple different sites, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results. The evaluation unit constructs corresponding first prompt information based on preset target recognition requirement information. Based on the first prompt information, it uses a multimodal large model to evaluate each rule in the rule population in multiple different modalities on the verification dataset, thereby obtaining the evaluation result of the rule population. The evaluation result of the rule population includes one or more of the following: the risk identification result corresponding to the verification dataset, the confidence level of the risk identification result corresponding to the verification dataset, the reasoning chain of the risk identification result corresponding to the verification dataset, the analysis information of the verification data samples with incorrect risk identification results in the verification dataset, and the rule applicability evaluation result.

[0087] In this embodiment of the specification, the iterative optimization module 804 includes: The rule selection unit, based on the evaluation results of the rule population, obtains multiple different second risk identification rules that meet preset conditions from the rule population; The mutation unit determines the difference information between different second risk identification rules, selects one second risk identification rule from multiple different second risk identification rules (excluding the two second risk identification rules corresponding to the difference information), and generates a mutation risk identification rule based on the selected second risk identification rule and the difference information. The cross-operation unit performs a cross-operation on the mutation risk identification rule and the second risk identification rule corresponding to the mutation risk identification rule to generate a third risk identification rule; The selection unit evaluates the multiple different second risk identification rules and the generated third risk identification rules in multiple different modes using a preset multimodal large model to obtain the corresponding target evaluation results. Based on the obtained target evaluation results, risk identification rules that meet preset conditions are selected from the multiple different second risk identification rules and the generated third risk identification rules. The differential evolution algorithm is then used for iterative optimization until a preset number of iterations is reached. An optimized rule population is constructed based on the risk identification rules that meet the preset conditions selected in each iteration.

[0088] In the embodiments of this specification, the evaluation result of the rule population includes the analysis information of the verification data samples with incorrect risk identification results in the verification dataset, and the device further includes: The misjudgment scenario determination module determines the misjudgment scenario information corresponding to the verification data samples with incorrect risk identification results based on the analysis information of the verification data samples with incorrect risk identification results in the verification dataset. The misjudgment scenario information includes one or more of the following: confusion between normal download pages and inducement download pages, confusion between normal customer service pages and fraudulent traffic redirection pages, confusion between legitimate information pages and illegal advertorial pages, and confusion between normal e-commerce promotion pages and fake rebate pages. The model correction module provides the misjudged scenario information to the first large language model so that the boundary conditions and / or exclusion conditions in the first risk identification rule generated for the target site can be corrected by the first large language model.

[0089] In the embodiments described in this specification, the device further includes: The data acquisition module acquires target data, which includes one or more of the following: a first verification data sample whose confidence level of the risk identification result corresponding to the verification dataset is less than a preset confidence threshold, a second verification data sample in the verification dataset with incorrect risk identification results, and a new type of network site with preset risks. The difficult sample construction module constructs difficult samples for rule evaluation based on the target data, and updates the verification dataset based on the difficult samples.

[0090] In the embodiments described in this specification, the device further includes: The data acquisition module acquires the evaluation report of each rule in the optimized rule population, the iterative optimization log and hard sample analysis report corresponding to the optimized rule population, and acquires the risk identification rules and / or sub-rules for different risk types in the risk identification rules for the target site. The evaluation report includes one or more of the following: accuracy, recall, false positive rate, and F1 score. The output module outputs risk identification rules for the target site, an evaluation report for each rule in the optimized rule population, an iterative optimization log and a hard sample analysis report corresponding to the optimized rule population, as well as risk identification rules and / or sub-rules for different risk types.

[0091] In this embodiment of the specification, the rule generation module 802 includes: The auxiliary information acquisition unit acquires auxiliary information of the target website, including one or more of the following: graph feature information, filing information, page interaction behavior trajectory, report information, and review feedback information corresponding to the target website. The rule generation unit, based on the prompt information, uses a first major language model to generate a first risk identification rule for the target site based on the site information and the auxiliary information.

[0092] In the embodiments described in this specification, the device further includes: The deployment module deploys the determined risk identification rules for the target site to the access services of the target network site; The auxiliary information acquisition module, when receiving an access request for the target website initiated by the target user, acquires the identification auxiliary information corresponding to the target website. The identification auxiliary information includes one or more of the following: graph feature information, filing information, page interaction behavior trajectory, report information, and review feedback information corresponding to the target website. The risk identification module performs risk identification processing on the access request based on the identification assistance information and the determined risk identification rules for the target site.

[0093] For ease of description, the above devices are described by dividing them into various modules or units based on their functions. Of course, when implementing one or more embodiments of this specification, the functions of each module or unit can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative; the division of each module and unit is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or modules can be combined or integrated into another system, or some features can be ignored or not executed, etc.

[0094] This specification provides a device for processing risk identification rules for a website. It acquires website information of a target website, including text content, webpage screenshots, page structure information, URL information, historical tag information, and one or more of the website's risk assessment results. Then, it constructs corresponding prompts based on preset website identification requirements. Based on these prompts, it uses a first large language model to generate a first risk identification rule for the target website. Subsequently, it expands the first risk identification rule to obtain a rule population for the target website. Finally, it uses a preset multimodal large language model to perform multi-modal analysis on each rule in this rule population. The evaluation results of the rule population are obtained through evaluations of different modalities. Finally, based on the evaluation results of the rule population, the rule population can be iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined. In this way, the initial rules are automatically generated by the first large language model and automatically iteratively optimized by the differential evolution algorithm. This not only significantly reduces the cost and efficiency of writing and updating rules, but also improves convergence efficiency and optimization quality. Moreover, the introduction of a multimodal large model to jointly evaluate text, page screenshots, button layouts, and image copywriting improves the identification effect of fake pages, image copywriting, and brand counterfeit pages, thereby improving the accuracy of risk identification.

[0095] The above describes the site risk identification rule processing apparatus provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a site risk identification rule processing device, such as... Figure 9 As shown.

[0096] The processing device for the risk identification rules of the site can be a terminal device or a server, as described in the above embodiments.

[0097] The processing device for risk identification rules at a site can vary significantly due to differences in configuration and performance. It may comprise a communication interface 902, a user interface 904, a processor 906, and data storage 908. These components are interconnected and communicate with each other via a system bus, network, or other connection mechanism 910. The communication interface 902 enables the site's risk identification rule processing device 900 to communicate with other devices, access networks, and transmission networks via analog or digital modulation. For example, the communication interface 902 may include a chipset and antenna for wireless communication with a radio access network or access point. Furthermore, the communication interface 902 can be a wired interface such as Ethernet, Token Ring, or a USB port, or a wireless interface such as Wi-Fi, Bluetooth, Global Positioning System (GPS), or a wide-area wireless interface (e.g., WiMAX or LTE). Of course, the communication interface 902 may also support other forms of physical layer interfaces and standard or proprietary communication protocols. The communication interface 902 may also include multiple physical communication interfaces, such as Wi-Fi, Bluetooth, and wide-area wireless interfaces.

[0098] User interface 904 includes receiving user input and providing output to the user. Therefore, user interface 904 may include input components such as a keypad, keyboard, touch-sensitive or presence-sensitive panel, computer mouse, trackball, joystick, microphone, still camera, and video camera, and output components such as a display screen (which may be combined with a touch-sensitive panel), CRT, LCD, LED, display using DLP technology, printer, and other similar devices known or developed in the future. User interface 904 may also generate auditory output via speakers, speaker jacks, audio output ports, audio output devices, headphones, and other similar devices known or developed in the future. In some embodiments, user interface 904 may include software, circuitry, or other forms of logic capable of transmitting and receiving data from external user input / output devices. Additionally or alternatively, the site's risk identification rule processing device 900 may support remote access from other devices via communication interface 902 or another physical interface (not shown). User interface 904 may be configured to receive user input, the position and movement of which may be indicated by indicators or cursors described herein. User interface 904 can also be configured as a display device for rendering or displaying text fragments.

[0099] Processor 906 may contain one or more general-purpose processors and / or special-purpose processors.

[0100] Data storage 908 may include one or more volatile and / or non-volatile storage components and may be integrated wholly or partially with processor 906. Data storage 908 may include removable and non-removable components.

[0101] Processor 906 is capable of executing program instructions 918 (e.g., compiled or uncompiled program logic and / or machine code) stored in data storage 908 to perform the various functions described herein. Data storage 908 may contain a non-transitory computer-readable medium on which program instructions are stored, which, when executed by the site risk identification rule processing device 900, enable the site risk identification rule processing device 900 to perform any methods, processes, or functions disclosed in this specification and / or the accompanying drawings. Execution of program instructions 918 by processor 906 may result in processor 906 using data 912.

[0102] For example, program instructions 918 may include an operating system 922 (e.g., an operating system kernel, device drivers, and / or other modules) and one or more applications 920 (e.g., a browser, social application, or game application) installed on the risk identification rules processing device 900 of the site. Similarly, data 912 may include operating system data 916 and application data 914. Operating system data 916 is primarily accessible to the operating system 922, while application data 914 is primarily accessible to one or more applications 920. Application data 914 may reside in a file system that is visible or hidden from the user of the risk identification rules processing device 900 of the site.

[0103] Application 920 can communicate with operating system 912 through one or more application programming interfaces (APIs). These APIs help application 920 read and / or write application data 914, transmit or receive information via communication interface 902, receive or display information on user interface 904, etc.

[0104] In some terminology, application 920 may be simply referred to as "app". Furthermore, application 920 may be downloaded to the risk identification rules processing device 900 of the site via one or more online app stores or app markets. However, the application may also be installed on the risk identification rules processing device 900 of the site in other ways, such as through a web browser or a physical interface (e.g., a USB port) on the risk identification rules processing device 900 of the site.

[0105] Specifically, in this embodiment, the risk identification rule processing device 900 for a site includes a data storage 908 and one or more program instructions 918, wherein one or more program instructions 918 are stored in the data storage 908, and one or more program instructions 918 are configured to be executed by one or more processors. The one or more program instructions include computer-executable instructions for performing the following: Obtain site information of the target website to be identified, wherein the site information includes one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; Based on the preset site identification requirements information, corresponding prompt information is constructed. Based on the prompt information, the first major language model is used to generate a first risk identification rule for the target site based on the site information. The first risk identification rule is extended to obtain a rule population for the target site. Each rule in the rule population is evaluated in multiple different modalities using a preset multimodal large model to obtain the evaluation result of the rule population. Based on the evaluation results of the rule population, the rule population is iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined.

[0106] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, the embodiment for processing site risk identification rules is relatively simple in description because it is fundamentally similar to the method embodiment; relevant parts can be referred to the descriptions in the method embodiment.

[0107] This specification provides a device for processing risk identification rules for a website. It acquires website information of the target website to be identified, including one or more of the following: text content, webpage screenshots, page structure information, URL information, historical tag information, and website risk audit results. Then, it constructs corresponding prompts based on preset website identification requirements. Based on these prompts, it uses a first large language model to generate a first risk identification rule for the target website. Subsequently, it expands the first risk identification rule to obtain a rule population for the target website. Each rule in this rule population is then processed using a preset multimodal large language model. The evaluation results of the rule population are obtained through evaluations of different modalities. Finally, based on the evaluation results of the rule population, the rule population can be iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined. In this way, the initial rules are automatically generated by the first large language model and automatically iteratively optimized by the differential evolution algorithm. This not only significantly reduces the cost and efficiency of writing and updating rules, but also improves convergence efficiency and optimization quality. Moreover, the introduction of a multimodal large model to jointly evaluate text, page screenshots, button layouts, and image copywriting improves the identification effect of fake pages, image copywriting, and brand counterfeit pages, thereby improving the accuracy of risk identification.

[0108] Furthermore, the final output includes not only structured identification rules but also relevant report information suitable for auditing, review, strategy linkage, and compliance interpretation. Through difficult sample mining and confusion feedback mechanisms, risk identification rules can be automatically optimized for new variant samples, improving adaptability to rapidly changing scenarios. Additionally, differential evolution algorithms are used for the generation, mutation, crossover, and selection of individual rules, enabling automatic search and optimization at the rule level. Confusion features are extracted from misjudged samples and fed back into the rule generation and optimization process, enhancing the rule boundary identification capability. Moreover, it can automatically discover low-confidence samples and new variant samples, incorporating them into the next round of optimization, improving the system's robustness to unknown risk samples. This forms an integrated closed-loop architecture of "rule generation—evaluation—evolution—feedback," constructing a continuously evolving risk control identification system that differs from single-step model inference and static rule maintenance. While ensuring identification accuracy, it retains the explainable, auditable, and controllable characteristics of rules, making it more suitable for industrial-level risk prevention and control scenarios.

[0109] Furthermore, based on the above Figures 1 to 7 This specification also provides a storage medium for storing computer-executable instruction information in one or more embodiments. In one specific embodiment, the storage medium may be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can realize the following process: Obtain site information of the target website to be identified, wherein the site information includes one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; Based on the preset site identification requirements information, corresponding prompt information is constructed. Based on the prompt information, the first major language model is used to generate a first risk identification rule for the target site based on the site information. The first risk identification rule is extended to obtain a rule population for the target site. Each rule in the rule population is evaluated in multiple different modalities using a preset multimodal large model to obtain the evaluation result of the rule population. Based on the evaluation results of the rule population, the rule population is iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined.

[0110] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described storage medium embodiment is basically similar to the method embodiment, so the description is relatively simple; relevant parts can be referred to the description of the method embodiment.

[0111] This specification provides a storage medium that acquires site information of a target website to be identified. This site information includes one or more of the following: text content information, webpage screenshots, webpage structure information, URL information, historical tag information, and site risk assessment results. Then, based on preset site identification requirements, corresponding prompts can be constructed. Based on these prompts, a first large language model is used to generate a first risk identification rule for the target website. Subsequently, the first risk identification rule can be expanded to obtain a rule population for the target website. A preset multimodal large model is then used to apply multiple different modalities to each rule in this rule population. The evaluation results of the rule population are obtained. Finally, based on the evaluation results of the rule population, the rule population can be iteratively optimized using the differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined. In this way, the initial rules are automatically generated by the first large language model and automatically iteratively optimized by the differential evolution algorithm. This not only significantly reduces the cost and efficiency of writing and updating rules, but also improves convergence efficiency and optimization quality. Moreover, the introduction of a multimodal large model to jointly evaluate text, page screenshots, button layouts, image copy, etc., improves the identification effect of fake pages, image copy, and brand counterfeit pages, and improves the accuracy of risk identification.

[0112] Furthermore, based on the above Figures 1 to 7 This specification also provides one or more embodiments of a computer program product, including a computer program, which, when executed by a processor, can perform the following processes: Obtain site information of the target website to be identified, wherein the site information includes one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; Based on the preset site identification requirements information, corresponding prompt information is constructed. Based on the prompt information, the first major language model is used to generate a first risk identification rule for the target site based on the site information. The first risk identification rule is extended to obtain a rule population for the target site. Each rule in the rule population is evaluated in multiple different modalities using a preset multimodal large model to obtain the evaluation result of the rule population. Based on the evaluation results of the rule population, the rule population is iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined.

[0113] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described embodiment of a computer program product is relatively simple in description because it is fundamentally similar to the method embodiment; relevant parts can be referred to the description of the method embodiment.

[0114] This specification provides a computer program product that acquires site information of a target website to be identified. This site information includes one or more of the following: text content information, webpage screenshots, webpage structure information, URL information, historical tag information, and site risk assessment results. Then, based on preset site identification requirements, corresponding prompts can be constructed. Based on these prompts, a first large language model is used to generate a first risk identification rule for the target website. Subsequently, the first risk identification rule can be expanded to obtain a rule population for the target website. Each rule in this rule population is then processed using a preset multimodal large language model with multiple different... Modal evaluation yields the evaluation results of the rule population. Finally, based on the evaluation results of the rule population, the rule population can be iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined. In this way, the initial rules are automatically generated by the first large language model, and automatically iteratively optimized by the differential evolution algorithm. This not only significantly reduces the cost and efficiency of writing and updating rules, but also improves convergence efficiency and optimization quality. Moreover, the introduction of a multimodal large model to jointly evaluate text, page screenshots, button layouts, and image copywriting improves the identification effect of fake pages, image copywriting, and brand counterfeit pages, thereby improving the accuracy of risk identification.

[0115] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than those shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous. Moreover, although one or more embodiments of this specification provide method steps as described in the embodiments or flowcharts, it is understood that the order of steps listed in the embodiments or flowcharts is merely one possible execution order among many steps and does not represent the only execution order. Therefore, when method steps are involved in the claims, adjustments to the order of those steps, or parallelism between steps, are also within the scope of protection of the claims.

[0116] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0117] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0118] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0119] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0120] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0121] The embodiments described herein are illustrated with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0122] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0123] These computer program instructions may also be loaded onto a computer or other programmable device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0124] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0125] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0126] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0127] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical or equivalent elements in the process, method, article, or apparatus that includes said element. Furthermore, "a," "an," and "the" are not specifically singular and may include plural forms. Ordinal numbers such as "first," "second," etc., do not necessarily indicate order; they are often used to distinguish objects. For example, "first server" and "second server" usually refer to two servers, described as "first server" and "second server" to differentiate them; however, sometimes these two servers may be the same server. Moreover, in this specification, unless explicitly stated otherwise, "receiving and sending data" does not necessarily mean direct receiving and sending; it can be indirect receiving and sending (i.e., receiving and sending indirectly through one or more entities). Similarly, in this specification, unless otherwise stated, the relationships between structures can be direct or indirect.

[0128] Furthermore, the specific terms used in this specification to describe embodiments, such as "an embodiment," "one embodiment," or "some embodiments," refer to a particular feature, structure, or characteristic related to at least one embodiment of this specification. Therefore, it should be emphasized and noted that "an embodiment," "one embodiment," or "an alternative embodiment" mentioned twice or more in different locations in this specification do not necessarily refer to the same embodiment. Moreover, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples, without contradiction.

[0129] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0131] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0132] The above description is merely an embodiment of this specification and is not intended to limit this document. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims in this document.

Claims

1. A method for processing risk identification rules for a website, the method comprising: Obtain site information of the target website to be identified, wherein the site information includes one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; Based on the preset site identification requirements information, corresponding prompt information is constructed. Based on the prompt information, the first major language model is used to generate a first risk identification rule for the target site based on the site information. The first risk identification rule is extended to obtain a rule population for the target site. Each rule in the rule population is evaluated in multiple different modalities using a preset multimodal large model to obtain the evaluation result of the rule population. Based on the evaluation results of the rule population, the rule population is iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined.

2. The method according to claim 1, wherein constructing corresponding prompt information based on preset site identification requirement information includes: Obtain rule generation requirement information and preset site identification requirement information. The rule generation requirement information includes one or more of the following: rule generation format, rule generation dimension, and constraint conditions. The site identification requirement information includes the types of risks that need to be identified. Based on the rules, the required information and the preset site identification requirements are used to construct corresponding prompt information.

3. The method according to claim 1 or 2, wherein the first risk identification rule includes one or more of the following: page text triggering conditions, visual layout features, preset type of buttons, graphic codes, download guidance features, semantic patterns of brand counterfeiting, semantic patterns of inducing sharing, semantic patterns of customer service referral, and risk assessment and decision-making logic.

4. The method according to claim 1, wherein extending the first risk identification rule to obtain a rule population for the target site includes: The first risk identification rule is extended based on preset extension rules to generate multiple different candidate risk identification rules. Based on these multiple different candidate risk identification rules, a rule population for the target site is determined. The different candidate risk identification rules differ in at least one of the following dimensions: Differences in preset keyword combinations; Risk weight differences; Differences in conditional connection methods; Fuzzy description of granularity differences; Differences in the priority of visual cues.

5. The method according to claim 1, wherein the step of evaluating each rule in the rule population using multiple different modalities through a preset multimodal large model to obtain the evaluation result of the rule population includes: Obtain a verification dataset, which includes one or more of the following: text content information from multiple different sites, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; Based on the preset target recognition requirement information, a corresponding first prompt information is constructed. Based on the first prompt information, a multimodal large model is used to evaluate each rule in the rule population in multiple different modalities on the verification dataset to obtain the evaluation result of the rule population. The evaluation result of the rule population includes one or more of the following: the risk identification result corresponding to the verification dataset, the confidence level of the risk identification result corresponding to the verification dataset, the reasoning chain of the risk identification result corresponding to the verification dataset, the analysis information of the verification data samples with incorrect risk identification results in the verification dataset, and the rule applicability evaluation result.

6. The method according to claim 5, wherein the step of iteratively optimizing the rule population based on the evaluation results of the rule population using a differential evolution algorithm to obtain an optimized rule population includes: Based on the evaluation results of the rule population, multiple different second risk identification rules that meet preset conditions are obtained from the rule population; Determine the differential information between different second risk identification rules, and select one second risk identification rule from multiple different second risk identification rules, excluding the two second risk identification rules corresponding to the differential information. Based on the selected second risk identification rule and the differential information, generate a variation risk identification rule. A third risk identification rule is generated by performing a cross operation between the mutation risk identification rule and the second risk identification rule corresponding to the mutation risk identification rule. The multiple different second risk identification rules and the generated third risk identification rules are evaluated in multiple different modes using a preset multimodal large model to obtain the corresponding target evaluation results. Based on the obtained target evaluation results, risk identification rules that meet preset conditions are selected from the multiple different second risk identification rules and the generated third risk identification rules. Differential evolution algorithm is used for iterative optimization until a preset number of iterations is reached. An optimized rule population is constructed based on the risk identification rules that meet the preset conditions selected in each iteration.

7. The method according to claim 5, wherein the evaluation result of the rule population includes analysis information of verification data samples with incorrect risk identification results in the verification dataset, and the method further includes: Based on the analysis information of the verification data samples with incorrect risk identification results in the verification dataset, the misjudgment scenario information corresponding to the verification data samples with incorrect risk identification results is determined. The misjudgment scenario information includes one or more of the following: confusion between normal download pages and induced download pages, confusion between normal customer service pages and fraudulent traffic redirection pages, confusion between legitimate information pages and illegal advertorial pages, and confusion between normal e-commerce promotion pages and fake rebate pages. The misjudgment scenario information is provided to the first large language model so that the boundary conditions and / or exclusion conditions in the first risk identification rule generated for the target site can be corrected by the first large language model.

8. The method according to claim 7, further comprising: Acquire target data, which includes one or more of the following: a first verification data sample whose confidence level of the risk identification result corresponding to the verification dataset is less than a preset confidence threshold, a second verification data sample in the verification dataset with incorrect risk identification results, and a new type of network site with preset risks; Based on the target data, construct difficult samples for rule evaluation, and update the validation dataset based on the difficult samples.

9. The method according to claim 8, further comprising: Obtain the evaluation report for each rule in the optimized rule population, the iterative optimization log and the hard sample analysis report corresponding to the optimized rule population, and obtain the risk identification rules and / or sub-rules for different risk types in the risk identification rules for the target site. The evaluation report includes one or more of the following: accuracy, recall, false positive rate, and F1 score. Output risk identification rules for the target site, evaluation reports for each rule in the optimized rule population, iterative optimization logs and hard sample analysis reports corresponding to the optimized rule population, as well as risk identification rules and / or sub-rules for different risk types.

10. The method according to claim 1, wherein generating a first risk identification rule for the target site based on the prompt information and using a first large language model, based on the site information, includes: Obtain auxiliary information of the target website, the auxiliary information including one or more of the following: graph feature information, filing information, page interaction behavior trajectory, report information, and review feedback information corresponding to the target website; Based on the aforementioned prompt information, a first risk identification rule for the target site is generated using a first major language model, based on the site information and the auxiliary information.

11. The method according to claim 1, further comprising: The identified risk identification rules for the target site are deployed to the access services of the target network site. When an access request for the target website initiated by the target user is received, identification auxiliary information corresponding to the target website is obtained. The identification auxiliary information includes one or more of the following: graph feature information, filing information, page interaction behavior trajectory, report information, and review feedback information corresponding to the target website. The access request is processed for risk identification based on the identification assistance information and the determined risk identification rules for the target site.

12. A processing apparatus for risk identification rules of a site, the apparatus comprising: The information acquisition module acquires site information of the target website to be identified. The site information includes one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results. The rule generation module constructs corresponding prompt information based on preset site identification requirement information, and uses the first major language model to generate a first risk identification rule for the target site based on the site information. The rule extension module extends the first risk identification rule to obtain a rule population for the target site. It then evaluates each rule in the rule population using multiple different modalities through a preset multimodal large model to obtain the evaluation result of the rule population. The iterative optimization module, based on the evaluation results of the rule population, iteratively optimizes the rule population using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, it determines the risk identification rules for the target site.

13. A device for processing risk identification rules for a site, the device comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to: Obtain site information of the target website to be identified, wherein the site information includes one or more of the following: text content information of the target website, webpage screenshots, webpage page structure information, URL information, historical tag information, and site risk audit results; Based on the preset site identification requirements information, corresponding prompt information is constructed. Based on the prompt information, the first major language model is used to generate a first risk identification rule for the target site based on the site information. The first risk identification rule is extended to obtain a rule population for the target site. Each rule in the rule population is evaluated in multiple different modalities using a preset multimodal large model to obtain the evaluation result of the rule population. Based on the evaluation results of the rule population, the rule population is iteratively optimized using a differential evolution algorithm to obtain an optimized rule population. Based on the optimized rule population, risk identification rules for the target site are determined.

Images