A website information risk identification and auditing control method and system

Abstract

The present application belongs to the technical field of network security, and specifically relates to a website information risk identification and audit control method and system, comprising the following steps: S1. Global multi-modal information collection; S2. Multi-dimensional feature extraction and fusion; S3. Hierarchical intelligent risk identification; S4. Graded closed-loop audit control; S5. Model dynamic iteration optimization. The website information risk identification and audit control method and system realize full-dimensional risk identification of website text, image, link, code and dynamic update information through a multi-modal fusion algorithm, rely on a quantitative decision algorithm and an iteration optimization mechanism to realize pre-judgment, accurate control in the process and autonomous optimization after the event, greatly improve the intelligent, accurate and closed-loop level of website information security audit, effectively solve the problems of high misjudgment rate, response lag and poor adaptability of traditional technology, and are suitable for normal risk identification and audit control scenarios of various websites, and have good popularization and application value.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically a method and system for identifying and controlling website information risks. Background Technology

[0002] With the rapid popularization of internet technology, the number of government and enterprise websites, information platforms, e-commerce websites, and interactive social networking sites has continued to surge. The volume of information carried by these websites is growing exponentially, and information updates are characterized by real-time, fragmented, and dynamic features. As the core carrier of online information dissemination, websites contain numerous security risks related to the text, images, links, interactive content, and script code they publish. These risks include politically sensitive content, pornography and vulgarity, fraudulent traffic generation, copyright infringement, malicious code injection, page tampering, and loss of public opinion control. These risks not only affect the online ecosystem but also bring compliance risks and security incidents to website operators, and in severe cases, can trigger cybersecurity incidents and public opinion crises.

[0003] Currently, the industry's risk identification and review technologies for website information suffer from numerous inherent algorithmic and model defects, making it difficult to adapt to the dynamic and diversified risk scenarios of modern websites. Existing technologies mostly employ single-keyword matching algorithms or shallow backpropagation (BP) machine learning models for risk identification, exhibiting significant technical shortcomings: First, the identification dimension is limited, performing simple keyword matching and screening only on text content without multimodal feature fusion algorithms, ignoring risks from images, links, code scripts, and dynamic page changes, failing to achieve comprehensive risk coverage, and resulting in a very high false negative rate; second, static identification algorithms are outdated, mostly relying on reactive screening after the fact, lacking temporal prediction algorithms, and failing to capture hidden risks and phased abrupt changes during the dynamic updating of website information, making risk prediction difficult; third, semantic recognition models lack accuracy, and traditional basic pre-trained models lack website-specific scenarios. The system suffers from several shortcomings: First, it lacks adaptation and optimization, fails to capture structures with long-distance dependencies, and cannot identify implicitly sensitive semantics, ambiguous content, or fragmented violation information related to context, leading to significant issues of misjudgment and missed judgment. Second, it lacks a closed-loop review control system, which is mostly based on single-time screening and handling without a precise control strategy of hierarchical classification. Furthermore, it lacks an incremental iterative training algorithm, making it impossible to iteratively optimize models and rules based on historical review data, resulting in a lack of sustained improvement in long-term review effectiveness. Third, it has poor adaptability, with insufficient lightweight algorithm models, high computational costs, and an inability to meet the risk review needs of both static fixed pages and dynamically updated content, making it difficult to adapt to the differentiated risk control scenarios of different types of websites.

[0004] Therefore, a method and system for identifying and controlling website information risks are needed. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies and solve at least one of the technical problems mentioned in the background art, this invention proposes a method and system for website information risk identification and audit control.

[0006] First aspect

[0007] The technical solution adopted by this invention to solve its technical problem is: a website information risk identification and audit control method according to this invention, comprising the following steps:

[0008] S1. Full-domain multimodal information collection: Real-time capture of static page information and dynamic incremental update information of target websites, complete the standardized cleaning and structured preprocessing of multimodal raw information, remove invalid and redundant data, unify data format, and correct data deviations;

[0009] S2. Multi-dimensional feature extraction and fusion: Based on the preprocessed multi-modal information, five core risk features are extracted: semantic features, visual features, link topology features, code security features, and temporal update features. Through the feature weight adaptive fusion mechanism, the dimensional differences and redundant interference of different modal features are eliminated, and a unified comprehensive risk feature set of website information is generated.

[0010] S3. Layered Intelligent Risk Identification: Construct a multi-level risk identification architecture. The bottom layer completes the initial screening of explicit violation risks through a multi-granularity rule matching engine. The middle layer completes the accurate identification of implicit semantic risks and context-related risks through an improved pre-trained semantic understanding model. The top layer completes the prediction of dynamically evolving risks and potential unknown risks through a lightweight time-series risk prediction model, and outputs the risk type, risk level, risk location and risk diffusion trend of website information.

[0011] S4. Hierarchical Closed-Loop Audit Control: Based on the identified risk results, the risk levels are divided into high, medium and low according to the preset risk grading standards. Corresponding automated audit, manual review and emergency interception control strategies are matched. For confirmed risk information, control operations such as page removal, content tampering, link blocking, access throttling and script blocking are performed. At the same time, risk audit logs and control records are recorded.

[0012] S5. Dynamic Iterative Optimization of Models: Regularly collect audit results, user feedback, and risk omission and misjudgment data to build an incremental training dataset. Adaptively fine-tune the parameters of the semantic understanding model and the time series risk prediction model, and synchronously update the risk rule base and feature weight system to achieve continuous iterative upgrades of risk identification and audit control capabilities.

[0013] Furthermore, in S1, the dimensions of the full-domain multimodal information collection include text content, visualized images, hyperlinks, front-end script code, page jump logic, user interaction information and website server response data, and the standardized cleaning and structured preprocessing introduces an adaptive noise reduction and normalization algorithm.

[0014] By adopting the above technical solutions, the problems of noise redundancy, inconsistent dimensions, and garbled text deviation in the original collected data can be solved.

[0015] Furthermore, the extraction methods for the five core risk features described in S2 are as follows: semantic features are used to characterize the website's text content's tendency to violate regulations, public opinion guidance, and sensitive semantic relationships; visual features are used to identify illegal elements, tampering traces, and illegal identifiers in images and video visualizations; link topology features are used to analyze the legality of internal and external links, traffic redirection risks, and malware injection risks; code security features are used to detect vulnerabilities in front-end scripts and page code, malicious code injection, and unauthorized API calls; and temporal update features are used to capture the website's information update frequency, content mutations, and abnormal incremental change patterns.

[0016] By adopting the above technical solutions, semantic feature extraction uses a word vector pre-training mapping algorithm; visual feature extraction uses a lightweight image feature extraction algorithm; link topology feature extraction uses a topology traversal association algorithm; code security feature extraction uses a code feature matching parsing algorithm; and temporal update feature extraction uses a temporal incremental statistics algorithm.

[0017] Furthermore, the multi-granularity rule matching engine described in S3 has four built-in matching modes: precise matching, fuzzy matching, regular expression matching, and context-related matching. It has preset explicit risk rules for multiple categories, including politics, pornography, fraud, infringement, vulnerabilities, illegal traffic redirection, code vulnerabilities, and page tampering. It supports the customization of adding, modifying, deleting, and prioritizing rules, enabling rapid batch screening of explicit risks.

[0018] By adopting the above technical solutions, the multi-granularity rule matching engine uses a multi-granularity fusion matching algorithm and employs multi-condition parallel matching logic.

[0019] Furthermore, the improved pre-trained semantic understanding model described in S3 is built on a general pre-trained language model and adds a website domain semantic fine-tuning layer and a context long-distance dependency capture layer. It can adapt to semantic recognition scenarios of fragmented website text, pop-up text, comment interaction text, and nested page text, and solve the problem of low accuracy of traditional models in recognizing short sentences, fragmented content, and implicit ambiguity.

[0020] Furthermore, the lightweight time-series risk prediction model described in S3 is built on a time-series neural network architecture. It introduces an attention mechanism to assign weights to website information update data at different times, explores the dynamic change patterns of website information, and predicts short-term content mutation risks, long-term public opinion spread risks, and periodic violation update risks.

[0021] By adopting the above technical solution, a model is specifically adapted to the scenario of predicting time-series risks in the dynamic updating of website information. The model integrates a time-series convolution module and an attention mechanism, and takes historical time-series features and historical risk data as input to mine the periodic patterns, abnormal mutation patterns and risk evolution trends of website information updates.

[0022] Furthermore, the hierarchical closed-loop audit control described in S4 specifically includes: a lightweight audit strategy that implements automated marking, real-time monitoring, and periodic review for low-risk information; a dual audit mode of intelligent initial review + manual review for medium-risk information, which allows information to pass the review and implements rectification control if it fails; and a second-level emergency interception mechanism that triggers high-risk information, which simultaneously locks the risk page, blocks access channels, retains risk evidence, and pushes alarm information to the audit terminal.

[0023] By adopting the above technical solutions, the hierarchical closed-loop audit control introduces a multi-factor risk classification decision algorithm. Combining three core factors—risk hazard weight, diffusion range coefficient, and duration of continuous impact—it constructs a standardized risk classification system, accurately classifies high, medium, and low risk levels, and matches differentiated closed-loop audit control strategies to solve the problems of traditional audits being one-size-fits-all, imprecise control, and lacking a closed loop.

[0024] Furthermore, in S5, the model dynamic iterative optimization introduces the incremental gradient descent iterative optimization algorithm, which regularly collects historical risk identification data, manually reviewed and corrected data, missed and misjudged samples, and user feedback data to build a continuously updated incremental training dataset.

[0025] Second aspect

[0026] A website information risk identification and audit control system is used to execute website information risk identification and audit control methods, including a multimodal information collection and preprocessing module, a multi-dimensional feature fusion module, a hierarchical intelligent risk identification module, a hierarchical audit control module, a model iteration and optimization module, and a data storage and alarm module.

[0027] The multimodal information acquisition and preprocessing module is used to collect various types of information from the target website in real time and complete data cleaning, format standardization, and deduplication and noise reduction preprocessing.

[0028] The multi-dimensional feature fusion module is used to extract five core risk features from multimodal information and generate a comprehensive risk feature set through an adaptive weight fusion mechanism.

[0029] The hierarchical intelligent risk identification module incorporates a multi-granularity rule matching engine, an improved pre-trained semantic understanding model, and a lightweight time-series risk prediction model to achieve comprehensive identification of explicit, implicit, and dynamic potential risks in a hierarchical manner.

[0030] The hierarchical audit control module is used to classify risk levels based on risk identification results, match corresponding audit control strategies, and perform risk handling, log recording, and closed-loop control.

[0031] The model iteration and optimization module is used to complete incremental training of the model and dynamic updates of the rule base and weight system based on historical audit data and error data.

[0032] The data storage and alarm module is used to store raw data, feature data, risk identification results, and audit and control logs, and to provide real-time pop-up, SMS, and background push alarms for medium- and high-risk events.

[0033] Furthermore, the multi-dimensional feature fusion module includes a semantic feature extraction unit, a visual feature extraction unit, a link topology feature extraction unit, a code security feature extraction unit, a temporal update feature extraction unit, and a multi-head attention adaptive fusion unit. Specifically, the semantic feature extraction unit employs a word vector pre-training mapping algorithm to semantically encode website content, pop-ups, comments, and nested text, extracting features related to sensitive semantic associations, sentiment tendencies, and public opinion guidance. The visual feature extraction unit uses a lightweight image feature extraction algorithm, extracting image color, texture, target elements, and tampering traces through convolutional sampling. The link topology feature extraction unit uses a topology traversal association algorithm to traverse all internal and external links, extracting features related to jump paths, domain associations, activity levels, and spoofing. The code security feature extraction unit uses a code feature matching and parsing algorithm to extract features related to vulnerability risks, malicious implantation, and unauthorized calls. The temporal update feature extraction unit uses a temporal incremental statistical algorithm to extract features related to update frequency, content mutation amplitude, and abnormal fluctuations.

[0034] The multi-head attention adaptive fusion unit is equipped with an attention adaptive fusion algorithm to calculate the contribution weights of five types of features to risk identification, eliminate the dimensional and dimensional differences between different modalities, and finally generate a comprehensive risk feature set with a unified dimension. The feature set output by the multi-head attention adaptive fusion unit can be directly input into the hierarchical intelligent risk identification module. At the same time, the multi-head attention adaptive fusion unit can receive weight optimization instructions from the model iteration optimization module, dynamically adjust the feature fusion weights, and continuously improve the accuracy of feature representation.

[0035] Furthermore, the hierarchical review and control module is equipped with a risk result integration unit. The risk result integration unit is responsible for integrating the three-layer identification output results, uniformly quantifying the risk score, marking the risk type, risk level, precise location of the risk and diffusion trend, forming a complete risk identification report, and sending it to the hierarchical review and control module. At the same time, the risk result integration unit records suspected misjudgments and omissions in the identification process and synchronously feeds them back to the model iteration and optimization module.

[0036] The beneficial effects of this invention are as follows:

[0037] 1. The website information risk identification and audit control method and system described in this invention achieves full-domain, real-time, and accurate risk identification of website multimodal information through multimodal dedicated algorithms, hierarchical intelligent models, adaptive fusion algorithms, and closed-loop decision algorithms, constructs a hierarchical closed-loop audit control system, and continuously improves the website information security risk control capabilities.

[0038] 2. This invention pioneers a multi-algorithm collaborative multimodal risk control system, breaking through the limitations of traditional single algorithms. It deeply integrates normalization preprocessing algorithms, multi-dimensional feature extraction algorithms, attention fusion algorithms, hierarchical recognition models, time-series prediction algorithms, and incremental iteration algorithms, covering five major risk dimensions: website text, images, links, code, and time series. This achieves full coverage of all risks—static, dynamic, explicit, and implicit—solving the problem of high false negative rates in existing technologies and improving risk identification coverage.

[0039] 2. Layered algorithm model for progressive recognition, balancing recognition efficiency and accuracy. Through a three-layer architecture of high-speed initial screening using a bottom-layer rule matching algorithm, accurate latent detection using a middle-layer improved semantic model, and dynamic prediction using a top-layer temporal model, complementary and empowering each other, it effectively solves the challenges of identifying latent semantics, fragmented content, and dynamic mutation risks. Compared with traditional single models, the false positive rate and false negative rate are effectively reduced.

[0040] 3. Introduce a lightweight time-series prediction algorithm to achieve proactive risk assessment. By mining the dynamic evolution patterns of website information through a lightweight time-series attention convolution model, it accurately predicts short-term sudden risks and medium- to long-term public opinion risks, completely changing the traditional reactive post-event handling model and achieving a technological upgrade in risk control from passive defense to proactive assessment;

[0041] 4. Multi-factor hierarchical decision-making algorithm for precise closed-loop management. Based on a multi-factor risk scoring algorithm, risk levels are quantitatively classified and matched with differentiated review strategies. This solves the drawbacks of the traditional one-size-fits-all review approach, achieving lightweight, precise, and fully traceable closed-loop management, adaptable to various website risk control scenarios.

[0042] 5. Equipped with an incremental iterative optimization algorithm, it possesses long-term self-upgrading capabilities. Through the incremental gradient descent algorithm, it achieves dynamic fine-tuning of model parameters and synchronous updates to the rules and weight system. This allows it to autonomously adapt to new and changing characteristics of network risks, solving the problems of poor adaptability and late-stage failure of traditional static algorithm models, thus continuously improving long-term risk control performance. Attached Figure Description

[0043] The invention will now be further described with reference to the accompanying drawings.

[0044] Figure 1 This is a schematic diagram of the method flow in this invention;

[0045] Figure 2 This is a schematic diagram of the system flow in this invention. Detailed Implementation

[0046] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0047] Example 1

[0048] like Figure 1 As shown in the figure, a website information risk identification and audit control method according to an embodiment of the present invention includes the following steps:

[0049] S1. Full-domain multimodal information collection: Real-time capture of static page information and dynamic incremental update information of target websites, complete the standardized cleaning and structured preprocessing of multimodal raw information, remove invalid and redundant data, unify data format, and correct data deviations;

[0050] In S1, the dimensions of the full-domain multimodal information collection include text content, visual images, hyperlinks, front-end script code, page jump logic, user interaction information and website server response data. The standardized cleaning and structured preprocessing introduces an adaptive noise reduction and normalization algorithm to solve the problems of noise redundancy, inconsistent dimensions, and garbled text deviation in the original collected data.

[0051] The specific strategy of the adaptive noise reduction normalization algorithm is to first define the original collected dataset as follows: ,in, For a single piece of multimodal raw data, including but not limited to text content, visual images, hyperlinks, front-end script code, page navigation logic, user interaction information, and website server response data from different dimensions, invalid and redundant data is removed using a noise filtering formula: ,in, The coefficient for determining the validity of the data; , The threshold is adaptive and dynamically adjusted according to different modal data dimensions. If the coefficient is 0, the invalid data is removed.

[0052] Subsequently, the maximum-minimum normalization algorithm was used to complete the data standardization process. The normalization formula is as follows: ,in, For standardized data, , To match the maximum and minimum values ​​of the modal data, all modal data are unified to the [0,1] interval to eliminate dimensional differences;

[0053] Simultaneously, it is equipped with algorithms for garbled character correction and fragmented data repair, ultimately outputting a structured and standardized multimodal dataset. This provides high-quality data support for subsequent feature extraction and risk identification.

[0054] S2. Multi-dimensional feature extraction and fusion: Based on the preprocessed multi-modal information, five core risk features are extracted: semantic features, visual features, link topology features, code security features, and temporal update features. Through the feature weight adaptive fusion mechanism, the dimensional differences and redundant interference of different modal features are eliminated, and a unified comprehensive risk feature set of website information is generated.

[0055] The extraction methods for the five core risk features described in S2 are as follows: semantic features are used to characterize the website's text content's tendency to violate regulations, public opinion guidance, and sensitive semantic relationships; visual features are used to identify illegal elements, tampering traces, and illegal identifiers in images and video visualizations; link topology features are used to analyze the legality of internal and external links, traffic redirection risks, and malware injection risks; code security features are used to detect vulnerabilities in front-end scripts and page code, malicious code injection, and unauthorized API calls; and time-series update features are used to capture the website's information update frequency, content mutations, and abnormal incremental change patterns.

[0056] Semantic feature extraction employs a word vector pre-training mapping algorithm to semantically encode all text data, including website content, pop-ups, comments, and nested text, mapping discrete text into high-dimensional semantic vectors. The algorithm then mines lexical associations, sentence structure logic, sentiment, and sensitive semantic features using a semantic relevance calculation formula, outputting a text semantic feature vector. ;

[0057] Visual feature extraction employs a lightweight image feature extraction algorithm, performing convolutional sampling on website images, carousel images, and video frames to extract color, texture, target contours, and watermark tampering features. It then identifies illegal elements and tampering traces using an image similarity comparison formula, outputting a visual feature vector. ;

[0058] Link topology feature extraction employs a topology traversal association algorithm, traversing all internal and external links of the website, statistically analyzing redirect paths, domain relevance, and activity parameters. It then calculates the risk coefficients for traffic redirection, phishing, and malware injection using a link risk association formula, outputting a link topology feature vector. ;

[0059] Code security feature extraction employs a code feature matching and parsing algorithm to analyze front-end scripts and page code, extracting vulnerability features, malicious injection features, and unauthorized call features. It quantifies code security risks using a code anomaly calculation formula and outputs a code security feature vector. ;

[0060] Temporal update feature extraction employs a temporal incremental statistical algorithm to statistically analyze page update time, frequency, and content change magnitude. It captures abnormal update patterns using a temporal mutation calculation formula and outputs a temporal update feature vector. ;

[0061] After extracting the five types of feature vectors, S2 introduces a multi-head attention adaptive feature fusion algorithm to achieve adaptive weight allocation and fusion of multimodal features. The specific strategy is as follows:

[0062] First, construct a global feature set. The risk contribution weight of each feature is calculated using the attention scoring formula: ,in, For the first Normalized weights of class features For characteristic risk scoring functions; The weight matrix is ​​learnable; finally, a unified comprehensive risk feature set is generated through a weighted fusion formula: The multi-head attention adaptive feature fusion algorithm can automatically weaken the weights of low-redundancy and low-association features, strengthen the weights of high-risk core features, eliminate interference from multimodal dimensional differences, and generate a highly recognizable unified risk feature vector, providing accurate input for intelligent recognition.

[0063] S3. Layered Intelligent Risk Identification: Construct a multi-level risk identification architecture. The bottom layer completes the initial screening of explicit violation risks through a multi-granularity rule matching engine. The middle layer completes the accurate identification of implicit semantic risks and context-related risks through an improved pre-trained semantic understanding model. The top layer completes the prediction of dynamically evolving risks and potential unknown risks through a lightweight time-series risk prediction model, and outputs the risk type, risk level, risk location and risk diffusion trend of website information.

[0064] The multi-granularity rule matching engine described in S3 has four built-in matching modes: precise matching, fuzzy matching, regular expression matching, and context-related matching. It has preset explicit risk rules for multiple categories such as politics, pornography, fraud, infringement, vulnerabilities, illegal traffic redirection, code vulnerabilities, and page tampering. It supports the customization of adding, modifying, deleting, and prioritizing rules, enabling rapid batch screening of explicit risks.

[0065] The multi-granularity rule matching engine employs a multi-granularity fusion matching algorithm, utilizes multi-condition parallel matching logic, and defines a rule matching discrimination formula: ,in, These are the matching scores for the four matching modes; The algorithm matches risk scores to the final rules. When the matching score exceeds a preset explicit risk threshold, it is determined to be an explicit violation risk, completing a rapid batch initial screening that filters out most common violation risks, improving overall identification efficiency, and simultaneously narrowing the identification range for the upper-level model's refined identification. This algorithm supports dynamic sorting of rule priorities, custom addition and modification, and adapts to the compliance screening needs of different websites.

[0066] The improved pre-trained semantic understanding model described in S3 is built on a general pre-trained language model and adds a website domain semantic fine-tuning layer and a context long-distance dependency capture layer. It can adapt to semantic recognition scenarios of fragmented text, pop-up text, comment interaction text, and nested page text on websites, and solve the problem of low accuracy of traditional models in recognizing short sentences, fragmented content, and implicit ambiguity.

[0067] The innovation of the improved pre-trained semantic understanding model lies not only in adding a website domain semantic fine-tuning layer and a long-distance context dependency capture layer, but also in introducing a domain adversarial training algorithm to adapt to semantic recognition scenarios of fragmented, nested, and discontinuous text on websites. The core of the improved pre-trained semantic understanding model's forward propagation uses context semantic encoding calculation, capturing cross-text semantic relationships through a long-distance dependency weight formula. ,in, These are respectively the text semantic query vector, key vector, and value vector; For vector dimensions; To enhance contextual semantic features; by using a domain fine-tuning layer to weaken general text semantic interference, enhance the ability to extract website-specific semantic features, accurately identify implicit sensitive expressions, ambiguous content, and disguised illegal information, solve the problems of low accuracy in short sentence recognition and missed detection of implicit risks in traditional models, and output refined semantic risk scores and implicit risk types.

[0068] The lightweight time-series risk prediction model described in S3 is built on a time-series neural network architecture. It introduces an attention mechanism to assign weights to website information update data at different times, explores the dynamic change patterns of website information, and predicts short-term content mutation risks, long-term public opinion spread risks, and periodic illegal update risks.

[0069] Specifically adapted to the scenario of predicting time-series risks in the context of dynamic updates of website information, the model integrates a time-series convolution module and an attention mechanism. Taking historical time-series features and historical risk data as input, it explores the periodic patterns, abnormal mutation patterns and risk evolution trends of website information updates.

[0070] The core time series feature update formula of the lightweight time series risk prediction model is: ,in, This is a temporal convolution operation used to extract temporal local variation features; This is a temporal attention operation used to assign differentiated weights to data from different time periods; For activation functions; For feature concatenation operations; Predict risk characteristics for the next moment;

[0071] The lightweight time-series risk prediction model outputs prediction results through the time-series risk discrimination formula: ,in, This model uses dynamic risk probability values ​​to determine the levels of short-term sudden risks, medium- to long-term public opinion spread risks, and periodic violation risks based on probability intervals, thus upgrading from "post-event screening" to "pre-event prediction and in-event control." The model employs a lightweight convolutional kernel design to reduce redundant parameters, significantly reducing computational power consumption while maintaining prediction accuracy, making it suitable for the real-time computational power requirements of websites.

[0072] The three-layer architecture algorithm model works collaboratively and complements each other, ultimately integrating and outputting a comprehensive risk identification result that includes risk type, risk level, precise risk location, and risk spread trend.

[0073] S4. Hierarchical Closed-Loop Audit Control: Based on the identified risk results, the risk levels are divided into high, medium and low according to the preset risk grading standards. Corresponding automated audit, manual review and emergency interception control strategies are matched. For confirmed risk information, control operations such as page removal, content tampering, link blocking, access throttling and script blocking are performed. At the same time, risk audit logs and control records are recorded.

[0074] The hierarchical closed-loop audit control described in S4 specifically includes: a lightweight audit strategy that implements automated marking, real-time monitoring, and periodic review for low-risk information; a dual audit mode of intelligent initial review + manual review for medium-risk information, which releases the information after the review is passed and implements rectification control if it fails; and a second-level emergency interception mechanism that triggers high-risk information, which simultaneously locks the risk page, blocks access channels, retains risk evidence, and pushes alarm information to the audit terminal.

[0075] The hierarchical closed-loop audit control introduces a multi-factor risk classification decision algorithm, which combines three core factors: risk hazard weight, diffusion range coefficient, and duration of continuous impact to build a standardized risk classification system. It accurately classifies three risk levels: high, medium, and low, and matches them with differentiated closed-loop audit control strategies to solve the problems of traditional audits being one-size-fits-all, imprecise control, and lack of closed loop.

[0076] The risk level scoring formula is as follows: ,in, Score the degree of harm; Score for the extent of diffusion; To affect the duration score; , , The weighting coefficients are adaptive, and the weight values ​​are obtained through iterative optimization using historical risk control data.

[0077] Risk levels are determined based on the overall score range, and corresponding management strategies are then applied.

[0078] (1) Low risk (low score range): For information with minor violations, no risk of spread, and self-rectification, implement automated marking, real-time monitoring, and regular batch review strategies without manual intervention, reducing the labor cost of review;

[0079] (2) Medium risk (medium score range): For information with certain potential violations and local spread risks, a dual review mode of "intelligent preliminary review + manual review" is adopted. After the intelligent preliminary review completes the risk verification, it is pushed to the manual review terminal. After the manual review confirms the violation, the content rectification, page correction and risk marking control are implemented. If the review is passed, the monitoring is lifted.

[0080] (3) High risk (high score range): For information that is seriously illegal, has rapid spread, or has major security risks, a second-level emergency interception mechanism is triggered to immediately lock the risk page, block access to the entire network, block illegal links, block the execution of malicious scripts, retain risk evidence, record control logs, and push multi-level alarm information to the audit management terminal in real time to achieve rapid risk mitigation;

[0081] All review, control, rectification, and interception operations are recorded throughout the process using a log retention algorithm, forming a complete and traceable review chain, enabling full-process risk control to be visualized, verifiable, and traceable.

[0082] S5. Dynamic Iterative Optimization of Models: Regularly collect audit results, user feedback, and risk omission and misjudgment data to build an incremental training dataset. Adaptively fine-tune the parameters of the semantic understanding model and the time series risk prediction model, and synchronously update the risk rule base and feature weight system to achieve continuous iterative upgrades of risk identification and audit control capabilities.

[0083] In S5, the model dynamic iterative optimization introduces the incremental gradient descent iterative optimization algorithm, which regularly collects historical risk identification data, manually reviewed and corrected data, missed and misjudged samples, and user feedback data to build a continuously updated incremental training dataset. This breaks the defects of the static and fixed traditional risk control model and realizes the autonomous upgrading of the algorithm model and rule system.

[0084] The core iterative optimization logic of the incremental gradient descent iterative optimization algorithm is: to calculate the error between the model's predicted values ​​and the true labeled values ​​using a loss function. The loss function formula is as follows: ,in, These are model parameters; This represents the number of incremental samples; The risk labels are manually labeled to reflect the actual risks. To predict risk outcomes for the model;

[0085] Update the model parameters in reverse using the incremental gradient descent algorithm: ,in, These are the updated parameters; These are the original parameters; Adaptive learning rate; The gradient of the loss function is used. Simultaneously, feature fusion weights are optimized, the risk rule base is updated, and risk classification thresholds are adjusted to continuously reduce the model's false positive and false negative rates, thereby constantly improving the model's scenario adaptability and recognition accuracy, and achieving long-term iterative upgrades to audit and control capabilities.

[0086] Example 2

[0087] Please see Figure 2 A website information risk identification and audit control system is used to execute website information risk identification and audit control methods, including a multimodal information collection and preprocessing module, a multi-dimensional feature fusion module, a hierarchical intelligent risk identification module, a hierarchical audit control module, a model iteration optimization module, and a data storage and alarm module;

[0088] The multimodal information acquisition and preprocessing module is used to collect various types of information from the target website in real time and complete data cleaning, format standardization, and deduplication and noise reduction preprocessing.

[0089] The multi-dimensional feature fusion module is used to extract five core risk features from multimodal information and generate a comprehensive risk feature set through an adaptive weight fusion mechanism.

[0090] The multi-dimensional feature fusion module includes a semantic feature extraction unit, a visual feature extraction unit, a link topology feature extraction unit, a code security feature extraction unit, a temporal update feature extraction unit, and a multi-head attention adaptive fusion unit. Specifically, the semantic feature extraction unit uses a word vector pre-training mapping algorithm to semantically encode website content, pop-ups, comments, and nested text, extracting features related to sensitive semantic associations, sentiment tendencies, and public opinion guidance. The visual feature extraction unit uses a lightweight image feature extraction algorithm, extracting image color, texture, target elements, and tampering traces through convolutional sampling. The link topology feature extraction unit uses a topology traversal association algorithm to traverse all internal and external links, extracting features such as jump paths, domain associations, activity levels, and spoofing. The code security feature extraction unit uses a code feature matching and parsing algorithm to extract features related to vulnerabilities, malicious injection, and unauthorized calls. The temporal update feature extraction unit uses a temporal incremental statistical algorithm to extract features related to update frequency, content mutation amplitude, and abnormal fluctuations.

[0091] The multi-head attention adaptive fusion unit is equipped with an attention adaptive fusion algorithm to calculate the contribution weights of five types of features to risk identification, eliminate the dimensional and dimensional differences between different modalities, and finally generate a comprehensive risk feature set with a unified dimension. The feature set output by the multi-head attention adaptive fusion unit can be directly input into the hierarchical intelligent risk identification module. At the same time, the multi-head attention adaptive fusion unit can receive weight optimization instructions from the model iteration optimization module, dynamically adjust the feature fusion weights, and continuously improve the accuracy of feature representation.

[0092] The hierarchical intelligent risk identification module incorporates a multi-granularity rule matching engine, an improved pre-trained semantic understanding model, and a lightweight time-series risk prediction model to achieve comprehensive identification of explicit, implicit, and dynamic potential risks in a hierarchical manner.

[0093] The hierarchical review and control module includes a risk result integration unit. This unit is responsible for integrating the three-layer identification output results, uniformly quantifying risk scores, marking risk types, risk levels, precise risk locations, and spread trends, forming a complete risk identification report, and sending it to the hierarchical review and control module. At the same time, the risk result integration unit records suspected misjudgments and omissions during the identification process and synchronously feeds them back to the model iteration and optimization module.

[0094] The hierarchical audit control module is used to classify risk levels based on risk identification results, match corresponding audit control strategies, and perform risk handling, log recording, and closed-loop control.

[0095] The model iteration and optimization module is used to complete incremental training of the model and dynamic updates of the rule base and weight system based on historical audit data and error data.

[0096] The data storage and alarm module is used to store raw data, feature data, risk identification results, and audit and control logs, and to provide real-time pop-up, SMS, and background push alarms for medium- and high-risk events.

[0097] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for identifying and controlling website information risks, characterized in that: Includes the following steps: S1. Full-domain multimodal information collection: Real-time capture of static page information and dynamic incremental update information of target websites, complete the standardized cleaning and structured preprocessing of multimodal raw information, remove invalid and redundant data, unify data format, and correct data deviations; S2. Multi-dimensional feature extraction and fusion: Based on the preprocessed multi-modal information, five core risk features are extracted: semantic features, visual features, link topology features, code security features, and temporal update features. Through the feature weight adaptive fusion mechanism, the dimensional differences and redundant interference of different modal features are eliminated, and a unified comprehensive risk feature set of website information is generated. S3. Layered Intelligent Risk Identification: Construct a multi-level risk identification architecture. The bottom layer completes the initial screening of explicit violation risks through a multi-granularity rule matching engine. The middle layer completes the accurate identification of implicit semantic risks and context-related risks through an improved pre-trained semantic understanding model. The top layer completes the prediction of dynamically evolving risks and potential unknown risks through a lightweight time-series risk prediction model, and outputs the risk type, risk level, risk location and risk diffusion trend of website information. S4. Hierarchical Closed-Loop Audit Control: Based on the identified risk results, the risk levels are divided into high, medium and low according to the preset risk grading standards. Corresponding automated audit, manual review and emergency interception control strategies are matched. For confirmed risk information, control operations such as page removal, content tampering, link blocking, access throttling and script blocking are performed. At the same time, risk audit logs and control records are recorded. S5. Dynamic Iterative Optimization of Models: Regularly collect audit results, user feedback, and risk omission and misjudgment data to build an incremental training dataset. Adaptively fine-tune the parameters of the semantic understanding model and the time series risk prediction model, and synchronously update the risk rule base and feature weight system to achieve continuous iterative upgrades of risk identification and audit control capabilities.

2. The website information risk identification and audit control method according to claim 1, characterized in that: In S1, the dimensions of the full-domain multimodal information collection include text content, visualized images, hyperlinks, front-end script code, page jump logic, user interaction information and website server response data. The standardized cleaning and structured preprocessing introduces an adaptive noise reduction and normalization algorithm. The extraction methods for the five core risk features described in S2 are as follows: semantic features are used to characterize the website's text content's tendency to violate regulations, public opinion guidance, and sensitive semantic relationships; visual features are used to identify illegal elements, tampering traces, and illegal identifiers in images and video visualizations; link topology features are used to analyze the legality of internal and external links, traffic redirection risks, and malware injection risks; code security features are used to detect vulnerabilities in front-end scripts and page code, malicious code injection, and unauthorized API calls; and time-series update features are used to capture the website's information update frequency, content mutations, and abnormal incremental change patterns.

3. The website information risk identification and audit control method according to claim 1, characterized in that: The multi-granularity rule matching engine described in S3 has four built-in matching modes: precise matching, fuzzy matching, regular expression matching, and context-related matching. It has preset explicit risk rules for multiple categories such as politics, pornography, fraud, infringement, vulnerabilities, illegal traffic redirection, code vulnerabilities, and page tampering. It supports the customization of adding, modifying, deleting, and prioritizing rules, enabling rapid batch screening of explicit risks.

4. The website information risk identification and audit control method according to claim 1, characterized in that: The improved pre-trained semantic understanding model described in S3 is built on a general pre-trained language model and adds a website domain semantic fine-tuning layer and a context long-distance dependency capture layer. It can adapt to semantic recognition scenarios of fragmented website text, pop-up text, comment interaction text, and nested page text, and solve the problem of low accuracy of traditional models in recognizing short sentences, fragmented content, and implicit ambiguity.

5. The website information risk identification and audit control method according to claim 1, characterized in that: The lightweight time-series risk prediction model described in S3 is built on a time-series neural network architecture. It introduces an attention mechanism to assign weights to website information update data at different times, explores the dynamic change patterns of website information, and predicts short-term content mutation risks, long-term public opinion spread risks, and periodic illegal update risks.

6. The website information risk identification and audit control method according to claim 5, characterized in that: The hierarchical closed-loop audit control described in S4 specifically includes: a lightweight audit strategy that implements automated marking, real-time monitoring, and periodic review for low-risk information; a dual audit mode of intelligent initial review + manual review for medium-risk information, which releases the information after the review is passed and implements rectification control if it fails; and a second-level emergency interception mechanism that triggers high-risk information, which simultaneously locks the risk page, blocks access channels, retains risk evidence, and pushes alarm information to the audit terminal.

7. The website information risk identification and audit control method according to claim 6, characterized in that: In S5, the model's dynamic iterative optimization introduces the incremental gradient descent iterative optimization algorithm, which periodically collects historical risk identification data, manually reviewed and corrected data, missed and misjudged samples, and user feedback data to build a continuously updated incremental training dataset.

8. A website information risk identification and audit control system, characterized in that, The method for implementing the website information risk identification and audit control method according to any one of claims 1-7 includes a multimodal information collection and preprocessing module, a multi-dimensional feature fusion module, a hierarchical intelligent risk identification module, a graded audit control module, a model iteration optimization module, and a data storage and alarm module. The multimodal information acquisition and preprocessing module is used to collect various types of information from the target website in real time and complete data cleaning, format standardization, and deduplication and noise reduction preprocessing. The multi-dimensional feature fusion module is used to extract five core risk features from multimodal information and generate a comprehensive risk feature set through an adaptive weight fusion mechanism. The hierarchical intelligent risk identification module incorporates a multi-granularity rule matching engine, an improved pre-trained semantic understanding model, and a lightweight time-series risk prediction model to achieve comprehensive identification of explicit, implicit, and dynamic potential risks in a hierarchical manner. The hierarchical audit control module is used to classify risk levels based on risk identification results, match corresponding audit control strategies, and perform risk handling, log recording, and closed-loop control. The model iteration and optimization module is used to complete incremental training of the model and dynamic updates of the rule base and weight system based on historical audit data and error data. The data storage and alarm module is used to store raw data, feature data, risk identification results, and audit and control logs, and to provide real-time pop-up, SMS, and background push alarms for medium- and high-risk events.

9. A website information risk identification and audit control system according to claim 8, characterized in that: The multi-dimensional feature fusion module includes a semantic feature extraction unit, a visual feature extraction unit, a link topology feature extraction unit, a code security feature extraction unit, a temporal update feature extraction unit, and a multi-head attention adaptive fusion unit. Specifically, the semantic feature extraction unit uses a word vector pre-training mapping algorithm to semantically encode website content, pop-ups, comments, and nested text, extracting features related to sensitive semantic associations, sentiment tendencies, and public opinion guidance. The visual feature extraction unit uses a lightweight image feature extraction algorithm, extracting image color, texture, target elements, and tampering traces through convolutional sampling. The link topology feature extraction unit uses a topology traversal association algorithm to traverse all internal and external links, extracting features such as jump paths, domain associations, activity levels, and spoofing. The code security feature extraction unit uses a code feature matching and parsing algorithm to extract features related to vulnerabilities, malicious injection, and unauthorized calls. The temporal update feature extraction unit uses a temporal incremental statistical algorithm to extract features related to update frequency, content mutation amplitude, and abnormal fluctuations. The multi-head attention adaptive fusion unit is equipped with an attention adaptive fusion algorithm to calculate the contribution weights of five types of features to risk identification, eliminate the dimensional and dimensional differences between different modalities, and finally generate a comprehensive risk feature set with a unified dimension. The feature set output by the multi-head attention adaptive fusion unit can be directly input into the hierarchical intelligent risk identification module. At the same time, the multi-head attention adaptive fusion unit can receive weight optimization instructions from the model iteration optimization module, dynamically adjust the feature fusion weights, and continuously improve the accuracy of feature representation.

10. A website information risk identification and audit control system according to claim 8, characterized in that: The hierarchical review and control module includes a risk result integration unit. This unit is responsible for integrating the three-layer identification output results, uniformly quantifying risk scores, marking risk types, risk levels, precise risk locations, and spread trends, forming a complete risk identification report, and sending it to the hierarchical review and control module. At the same time, the risk result integration unit records suspected misjudgments and omissions during the identification process and synchronously feeds them back to the model iteration and optimization module.

Images