A website content security monitoring method and system based on multi-dimensional semantic analysis

Abstract

The application discloses a website content security monitoring method and system based on multi-dimensional semantic analysis, relates to the field of website content security monitoring, and comprises the following steps: collecting and pre-processing website multi-version content and associated content; generating role status and a semantic relationship graph according to the content unit; screening stable semantic anchors and generating normal semantic benchmarks; comparing the current semantics with the normal semantic benchmarks, generating a combined risk residual and determining a candidate risk path; performing content unit deletion, same-role replacement and role connection disconnection, generating risk evidence and determining implicit combined risks; generating evidence migration status and risk evolution status; performing review and disposal, and feeding back updated stable semantic anchors, normal semantic benchmarks and evidence disposal status. The application adopts multi-dimensional semantic and counterfactual analysis, and has the advantages of precision, traceability and strong adaptability.

Description

Technical Field

[0001] This invention relates to the field of website content security monitoring, and in particular to a website content security monitoring method and system based on multidimensional semantic analysis. Background Technology

[0002] Currently, in the field of website content security monitoring, existing technologies typically employ keyword matching, sensitive word filtering, text classification, or single-page semantic recognition to detect explicit violations on web pages. These methods often assess isolated content units, making it difficult to consider the relationships between the subject, behavior, object, intent, and context. They also struggle to identify hidden risks arising from combinations of seemingly normal content, leading to missed detections and false alarms.

[0003] Meanwhile, existing technologies typically focus on static detection of the current page, lacking continuous tracking of different versions of the same website and related pages. This makes it difficult to determine the migration, spread, and enhancement of risky content within, between, and through links. Furthermore, there is a lack of an effective closed loop between detection results and manual review and feedback, making it impossible to continuously correct normal semantic benchmarks using review results. Consequently, monitoring results gradually become inaccurate as website content changes. Summary of the Invention

[0004] One objective of this invention is to propose a website content security monitoring method and system based on multidimensional semantic analysis. This invention employs multidimensional semantic and counterfactual analysis, which has the advantages of accuracy, traceability, and strong adaptability.

[0005] A website content security monitoring method based on multidimensional semantic analysis according to an embodiment of the present invention includes: Collect and preprocess multiple versions of website content and related content to generate content units and version relationships; Generate role states based on content units, and construct a semantic relationship graph based on the positional relationships, role succession relationships, and link relationships of content units; Stable semantic anchors are selected based on content units, role status, and version relationships, and normal semantic benchmarks are generated based on stable semantic anchors and semantic relationship graphs. Based on the semantic relationship graph, content units are sequentially associated and forward inference is performed to generate the current semantics. The current semantics are compared with the normal semantics benchmark to generate combined risk residuals and determine candidate risk paths. For candidate risk paths, content unit deletion, role replacement, and role connection disconnection are performed respectively to generate counterfactual semantics. The counterfactual semantics are compared with the normal semantics benchmark to generate counterfactual residuals. The combined risk residuals and counterfactual residuals are compared to generate residual reduction. Risk contribution units are determined according to residual reduction. Risk contribution units and corresponding role connection relationships are combined into risk evidence, and implicit combined risks are determined. By aligning the semantic relationship graphs of adjacent versions with stable semantic anchors, cross-version correspondences of risk contribution units and corresponding role inheritance relationships are established, and evidence migration status and risk evolution status are generated. Monitoring and early warning results are generated based on implicit combined risks, risk evidence, evidence migration status, and risk evolution status. The monitoring and early warning results are reviewed and processed, and feedback is provided to update stable semantic anchors, normal semantic benchmarks, and evidence processing status.

[0006] Optionally, the website multi-version content includes the page content of the same website page formed at different collection times and its corresponding version records. The associated content includes the page content that has a same domain reference, page jump, content reference or direct link relationship with the page to be monitored, as well as the link relationship between the associated pages and the page to be monitored. The preprocessing includes character encoding unification, whitespace character standardization, mark structure correction, invalid node deletion, duplicate page template removal and page structure parsing.

[0007] Optionally, the generation of the semantic relationship graph includes: Semantic parsing is performed on content units to identify subjects, behaviors, objects, intentions, and contexts, and to generate role states; Determine the positional relationship based on the structural path, page position, and arrangement order of the content unit; determine the link relationship based on the link target corresponding to the content unit. Perform role continuity and contextual conflict checks on content units that have positional or link relationships, and establish role succession relationships; A semantic relationship graph is constructed using content units as nodes, role status as node attributes, and positional relationships, role succession relationships, and link relationships as directed edges.

[0008] Optionally, the generation of the normal semantic benchmark includes: Associate the corresponding records of the same content unit in different page versions along the version relationship, and select stable semantic anchors based on the continuous occurrence status of the content unit, the consistency of the role status, and the stability of the association relationship in the semantic relationship graph. Centered on stable semantic anchors, related content units and their corresponding positional relationships, role succession relationships and link relationships are extracted from the semantic relationship graphs of different page versions to form historical semantic combinations. Consistency screening is performed on historical semantic combinations, and the role combinations, relationship combinations, and semantic fluctuation ranges corresponding to stable semantic anchors are statistically analyzed to generate normal semantic benchmarks.

[0009] Optionally, the generation of the combined risk residual and candidate risk path includes: Starting with the content unit corresponding to the stable semantic anchor point, the content units are sequentially associated along the positional relationship, role succession relationship and link relationship in the semantic relationship graph to generate candidate semantic paths; Pass and update the role status according to the content unit order in the candidate semantic path, and generate the current semantics by combining the relationship type and relationship direction; The current semantics are compared with the normal role combinations, normal relationship combinations and semantic fluctuation range in the corresponding normal semantics benchmark to generate role deviation residuals, relationship deviation residuals and semantic fluctuation out-of-bounds amounts, and then combined to generate combined risk residuals. Based on the residual sequence formed by adding content units sequentially with the combined risk residual, extract the content units that continuously exceed the risk boundary and their corresponding relationships to generate candidate risk paths.

[0010] Optionally, the generation of the implicit portfolio risk includes: The content units in the candidate risk paths are deleted, replaced with content units of the same role in the normal semantic benchmark, and the role connection relationship in the candidate risk paths is broken. Counterfactual semantics are then regenerated according to the connection order of the candidate risk paths. Each counterfactual semantic is compared with the normal semantic benchmark to generate counterfactual residuals, and the amount of residual reduction corresponding to the intervention is determined based on the combined risk residuals and counterfactual residuals. Based on the amount of residual reduction from each intervention, risk contribution units are determined, and risk contribution units are combined with the corresponding roles that caused the residual reduction to form risk evidence. For adjacent content units that have not individually reached the contribution boundary, joint intervention is performed. When the residual decrease corresponding to the joint intervention reaches the combination boundary and exceeds the sum of the residual decreases of each individual intervention, the implicit combination risk is determined.

[0011] Optionally, the generation of the evidence migration state and risk evolution state includes: Based on the version relationship, stable semantic anchors in adjacent page versions are matched. Using the matched stable semantic anchors as the alignment benchmark, the semantic relationship graph of adjacent page versions is aligned according to the connection path and structural position. Based on the version relationship and alignment results, risk contribution units in adjacent page versions are matched, and the connection endpoints and relationship directions of the role undertaking relationship corresponding to the risk contribution units are verified to establish cross-version correspondence. Based on the cross-version correspondence, the page location, structural path and corresponding role inheritance relationship of the corresponding risk contribution unit are compared to generate the evidence migration status. Compare the existence status, quantity, and risk contribution value of the corresponding risk contribution units in adjacent page versions, and generate the risk evolution status by combining the evidence migration status.

[0012] Optionally, the updating of the stable semantic anchor, normal semantic benchmark, and evidence handling status includes: The strength of evidence is determined based on risk evidence, the combination risk is marked based on implicit combination risks, and monitoring and early warning results and warning levels are generated by combining the evidence migration status and risk evolution status. According to the warning level, the monitoring and warning results are written into the corresponding review queue. Based on the review conclusion, the content is corrected, the role assignment relationship is corrected, the page is isolated and the warning is lifted, and the handling record is generated. The evidence handling status is updated based on the review conclusion, handling records, and post-handling verification results. The stable semantic anchor and normal semantic benchmark are updated based on the content units that are reviewed as normal and continuously verified as stable. Content units that are reviewed as risky and their corresponding page versions are excluded from the normal samples.

[0013] A website content security monitoring system based on multidimensional semantic analysis according to an embodiment of the present invention includes: The data acquisition module is used to collect and preprocess multiple versions of website content and related content, and generate content units and version relationships; The semantic graph module is used to generate role states based on content units and construct a semantic relationship graph based on the positional relationships, role succession relationships, and link relationships of content units. The benchmark generation module is used to filter stable semantic anchors based on content units, role status, and version relationships, and generate normal semantic benchmarks based on stable semantic anchors and semantic relationship graphs. The forward inference module is used to sequentially associate content units based on the semantic relationship graph and perform forward inference to generate the current semantics, compare the current semantics with the normal semantics benchmark, generate combined risk residuals and determine candidate risk paths; The counterfactual attribution module is used to perform content unit deletion, role replacement, and role connection disconnection on candidate risk paths, generate counterfactual semantics, compare the counterfactual semantics with the normal semantic benchmark, generate counterfactual residuals, compare the combined risk residuals with the counterfactual residuals, generate residual reduction, determine risk contribution units according to residual reduction, combine risk contribution units and corresponding role connection relationships into risk evidence, and determine implicit combined risks. The evolution tracking module is used to align the semantic relationship graph of adjacent versions with stable semantic anchors, establish cross-version correspondences of risk contribution units and corresponding role inheritance relationships, and generate evidence migration status and risk evolution status. The early warning feedback module is used to generate monitoring and early warning results based on implicit combined risks, risk evidence, evidence migration status and risk evolution status, review and handle the monitoring and early warning results, and provide feedback to update stable semantic anchors, normal semantic benchmarks and evidence handling status.

[0014] The beneficial effects of this invention are: This invention proposes a website content security monitoring method and system based on multidimensional semantic analysis. By uniformly collecting and structuring multi-version and related content of a website, page content is divided into content units, and role states are generated from dimensions such as subject, behavior, object, intent, and context. Furthermore, a semantic relationship graph is constructed by combining positional relationships, role succession relationships, and link relationships. This overcomes the reliance of traditional keyword matching and single-segment text classification on isolated content, and combines and analyzes semantic information scattered across different page locations, related pages, and different expression fragments. By selecting continuous and stable semantic anchors across versions, a normal semantic benchmark adapted to the website's own content structure and historical expression habits is constructed. Then, forward deduction is used to form the current semantics and calculate the combined risk residual. This effectively distinguishes between normal content fluctuations and abnormal semantic deviations, reducing false positives and false negatives caused by synonym substitution, veiled expressions, context separation, or page structure adjustments, and improving the accuracy and adaptability of identifying hidden content security risks on websites.

[0015] This invention also employs counterfactual interventions such as content unit deletion, role replacement, and role succession disconnection to perform attribution analysis on candidate risk paths. Based on the residual decrease before and after intervention, it determines the risk contributing unit and its corresponding role succession, thereby forming locatable and verifiable risk evidence. It also identifies implicit combined risks where individual content items do not cross boundaries but their combination creates risk. Simultaneously, by aligning adjacent page versions with stable semantic anchors, it establishes cross-version correspondences for risk contributing units and role succession, continuously identifying intra-page migration, cross-page migration, relationship changes, quantity diffusion, and contribution intensity changes of risk evidence, enhancing the ability to track the risk evolution process. Based on risk evidence, evidence migration status, and risk evolution status, it generates tiered monitoring and early warning results. The review and handling results are used to update the evidence handling status, stable semantic anchors, and normal semantic benchmarks, enabling the monitoring system to form a continuous feedback loop. This avoids performance degradation caused by long-term fixed normal benchmarks, improving monitoring stability, handling targeting, and website content security management efficiency under long-term operating conditions. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is an overall flowchart of a website content security monitoring method and system based on multidimensional semantic analysis proposed in this invention; Figure 2 This is a flowchart illustrating the counterfactual attribution and risk evidence generation of a website content security monitoring method and system based on multidimensional semantic analysis proposed in this invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figures 1-2 A website content security monitoring method based on multidimensional semantic analysis includes: Collect and preprocess multiple versions of website content and related content to generate content units and version relationships; Generate role states based on content units, and construct a semantic relationship graph based on the positional relationships, role succession relationships, and link relationships of content units; Stable semantic anchors are selected based on content units, role status, and version relationships, and normal semantic benchmarks are generated based on stable semantic anchors and semantic relationship graphs. Based on the semantic relationship graph, content units are sequentially associated and forward inference is performed to generate the current semantics. The current semantics are compared with the normal semantics benchmark to generate combined risk residuals and determine candidate risk paths. For candidate risk paths, content unit deletion, role replacement, and role connection disconnection are performed respectively to generate counterfactual semantics. The counterfactual semantics are compared with the normal semantics benchmark to generate counterfactual residuals. The combined risk residuals and counterfactual residuals are compared to generate residual reduction. Risk contribution units are determined according to residual reduction. Risk contribution units and corresponding role connection relationships are combined into risk evidence, and implicit combined risks are determined. By aligning the semantic relationship graphs of adjacent versions with stable semantic anchors, cross-version correspondences of risk contribution units and corresponding role inheritance relationships are established, and evidence migration status and risk evolution status are generated. Monitoring and early warning results are generated based on implicit combined risks, risk evidence, evidence migration status, and risk evolution status. The monitoring and early warning results are reviewed and processed, and feedback is provided to update stable semantic anchors, normal semantic benchmarks, and evidence processing status.

[0019] In this embodiment, the multiple versions of website content include the page content and its corresponding version records formed at different collection times of the same website page. The associated content includes the page content that has a same domain reference, page jump, content reference or direct link relationship with the page to be monitored, as well as the link relationship between the associated page and the page to be monitored. The preprocessing includes character encoding unification, whitespace character standardization, tag structure correction, invalid node deletion, duplicate page template removal and page structure parsing. Starting from the entry address of the website to be monitored, the initial collection of complete page content is obtained. The subsequent collection cycle is set to 30 minutes, the timeout for a single request is set to 10 seconds, and the retry is performed twice after failure. The collection cycle is determined based on the median of the website's historical update interval. When content changes are detected for three consecutive cycles, the collection cycle is shortened to half of the original collection cycle. When no content changes are detected for twelve consecutive cycles, the collection cycle is extended to twice the original collection cycle. For content units, titles, link texts, and comments in the page content are treated as independent content units. Body paragraphs, list items, and table units are divided according to their corresponding structural boundaries. When a single text exceeds 300 Chinese characters, it is split into continuous content units with a length of no more than 300 Chinese characters according to the sentence boundary. Content units with fewer than 15 Chinese characters and not belonging to titles or link text are merged with adjacent content units under the same parent node. Version relationships include the sequential relationship of page versions formed at different effective collection times for the same page, as well as the correspondence between content units in different page versions. The sequential relationship of page versions includes the direct sequential relationship between adjacent versions and the cross-version evolution relationship. The correspondence between content units includes the relationship of preservation, addition, deletion, replacement and migration.

[0020] In this embodiment, the generation of the semantic relationship graph includes: Semantic parsing is performed on content units to identify subjects, behaviors, objects, intentions, and contexts, and to generate role states; For each content unit, five role fields are set: subject, behavior, object, intention, and context. The corresponding semantic content and recognition status are recorded in each role field, and the correspondence between the five role fields is combined into role status. For the subject field, identify the person, organization, account, or other entity that performs the action or makes an expression within the content unit. Record the identified action initiator as the subject field. When the action initiator does not appear directly in the current content unit, supplement the corresponding subject based on the referential relationship in the context. If a unique subject cannot be determined, record the subject field as uncertain. For the behavior field, identify the action performed or expressed by the subject within the content unit. Record the action and its corresponding negation, restriction, or occurrence status together as the behavior field. When the same content unit contains multiple independent actions, record each action separately. For the object field, identify... The person, organization, matter, data, product, or page target that the behavior is directed to or affects is recorded as the object field. When a behavior corresponds to multiple parallel objects, each object is recorded separately. For the intent field, the purpose of informing, guiding, requesting, promising, inducing, restricting, or avoiding is determined based on the content and behavior of the content unit, and the determined purpose is recorded as the intent field. For the context field, the semantic environment of the content unit is determined based on the theme, column, body, reference, or comment attributes of the page where the content unit is located, and the determined semantic environment is recorded as the context field. Determine the positional relationship based on the structural path, page position, and arrangement order of the content unit; determine the link relationship based on the link target corresponding to the content unit. Regarding positional relationships, the structural path, page area identifier, and arrangement order of each content unit are read. The structural path is the hierarchical position of the content unit in the page structure. The page area identifier includes the title area, body area, list area, table area, comment area, and other page areas. The arrangement order is the order in which the content units are located within their respective page areas. The structural paths of any two content units are compared. When the structural node of one content unit is the parent node of the structural node of another content unit, they are determined to be in a hierarchical positional relationship, with the parent content unit pointing to the child content unit. When two content units are located under the same parent structural node and are arranged in adjacent order, they are determined to be in a peer-adjacent positional relationship, with the preceding content unit pointing to the following content unit. When one content unit is a title and the other content unit is located within the body area controlled by the title, they are determined to be in a title-related positional relationship, with the title content unit pointing to the corresponding body content unit. When one content unit is comment content and the other is its direct reply content, they are determined to be in a reply positional relationship, with the replied content unit pointing to the reply content unit. For link relationships, the relative addresses in the link targets corresponding to each content unit are fully converted, and additional parameters that do not affect the positioning of page content are removed to generate a standard link address. The standard link address is matched with the page address of the collected page. The content unit containing the link is determined as the link initiating content unit, and the page corresponding to the standard link address is determined as the link target page. A link relationship is established from the link initiating content unit to the link target page. When a content unit contains multiple links, the corresponding link relationship is established for each link. When the link target cannot be matched with the collected page, the standard link address and link direction are recorded. Perform role continuity and contextual conflict checks on content units that have positional or link relationships, and establish role succession relationships; Select a pair of content units to be verified from the content units with established positional or link relationships. Compare the subject field, behavior field, and object field of the two content units. If the subject, behavior, or object in the previous content unit appears in the next content unit with the same name, abbreviation, pronoun, ellipsis, or the same semantic content, it is determined that the corresponding role is continued to be referenced. If the next content unit adds the identity or scope of the aforementioned subject, adds the implementation method, condition, or result of the aforementioned behavior, or adds the attributes, composition, or related matters of the aforementioned object, it is determined that the corresponding role is supplemented. If the next content unit narrows the scope of application of the aforementioned subject, restricts the time, condition, or implementation of the aforementioned behavior, or limits the aforementioned object to a specific category, region, or usage condition, it is determined that the corresponding role is limited. If at least one field of the subject field, behavior field, or object field of the previous content unit is continued to be referenced, supplemented, or limited by the next content unit, it is determined that the two content units satisfy the role continuity. If the two content units only contain the same words, but the subject, behavior, and object do not form a continued reference, supplement, or limitation, it is determined that the two content units do not satisfy the role continuity. Compare the contextual fields of two content units and combine them with page columns, citation marks, comment relationships and transitional expressions to determine the semantic environment of the two content units. When the two content units belong to the original text and the citation description, the published content and the user comment, or the described content and the risk warning respectively, and the contextual differences can be clearly distinguished by the page structure or text marks, it is not judged as a contextual conflict. When the latter content unit denies, refutes, withdraws or changes the expressive position of the former content unit, and the two cannot form a relationship of continued citation, supplementation or limitation, it is judged as a contextual conflict. When two content units satisfy role continuity and there is no contextual conflict, establish a role succession relationship from the previous content unit to the next content unit, and record the role field where the succession occurs and the succession type of continued reference, supplementation or limitation. A semantic relationship graph is constructed using content units as nodes, role status as node attributes, and positional relationships, role succession relationships, and link relationships as directed edges.

[0021] In this embodiment, the generation of normal semantic benchmarks includes: Associate the corresponding records of the same content unit in different page versions along the version relationship, and select stable semantic anchors based on the continuous occurrence status of the content unit, the consistency of the role status, and the stability of the association relationship in the semantic relationship graph. Based on version relationships, the corresponding records of the same content unit in different page versions are connected in chronological order to generate a content unit version sequence. The number of appearing versions, the number of consecutive missing versions, the role status, and the relationship in the content unit version sequence are read. The 20 most recent valid page versions selected up to the current page version are used as anchor observation windows. The number of appearing versions is the number of valid page versions with corresponding records for the content unit to be screened in the anchor observation window. The number of consecutive missing versions is the number of valid page versions with consecutive missing records for the content unit to be screened, counted in chronological order of page versions. The maximum value in each consecutive missing segment in the anchor observation window is taken. The ratio of the number of appearing versions to the number of valid page versions in the anchor observation window is the consecutive appearance ratio. When the consecutive appearance ratio is not less than 80% and the consecutive missing versions do not exceed two page versions, the content unit is determined to meet the consecutive appearance condition. Further comparison of the subject fields, behavior fields, and object fields of the content unit to be screened in different page versions is conducted. Text semantic encoding is used to convert the text of each field into a field semantic vector, and the cosine similarity between semantic vectors of the same type of field is calculated. When the cosine similarity is not less than 0.88, the corresponding fields are determined to be consistent. For intent fields and context fields, when they belong to the same category, the corresponding fields are determined to be consistent. When at least four role fields are consistent in two page versions and the behavior fields are consistent, the role status of the two page versions is determined to be consistent. The number of adjacent versions with consistent role status is divided by the total number of comparable adjacent versions to generate the role consistency ratio. When the role consistency ratio is not less than the consistency ratio threshold, the content unit is determined to meet the role status consistency condition. The consistency threshold is determined by testing based on the labeled role status consistent samples and role status inconsistent samples, and the value corresponding to the minimum sum of the number of incorrect consistency and the number of incorrect inconsistency is determined as the consistency ratio threshold. Based on version relationships, directly linked content units in adjacent page versions are matched. If a directly linked content unit in the current page version can form a maintenance, replacement, or migration relationship with a content unit in the subsequent page version, the directly linked content unit is considered a successful match. The number of successfully matched directly linked content units is counted and divided by the larger of the number of directly linked content units in the two adjacent page versions to generate the corresponding proportion of related content. For each successfully matched directly linked content unit, its relationship type with the content unit to be filtered is compared. If the relationship types in the two adjacent page versions are both positional, both are both role-receiving, or both are link, the corresponding relationship type is considered consistent. The number of directly linked content units with consistent relationship types is divided by the number of successfully matched directly linked content units to generate the corresponding proportion of related content. The relationship type maintenance ratio is determined by dividing the number of adjacent version pairs with stable relationship by the total number of adjacent version pairs that can be compared within the anchor observation window. When the relationship type maintenance ratio is not lower than the threshold for associated content and the relationship type maintenance ratio is not lower than the threshold for relationship type, the adjacent version pairs are marked as having stable relationship. The stable relationship ratio is generated by dividing the number of adjacent version pairs with stable relationship by the total number of adjacent version pairs that can be compared within the anchor observation window. When the stable relationship ratio is not lower than 75%, the content unit to be screened is determined to meet the stable relationship condition. The associated content threshold and the relationship type threshold are determined based on the historical normal page versions of the website. Historical page versions that have been reviewed and have not experienced content security risks are selected. The associated content ratio and the relationship type maintenance ratio are calculated respectively. The lower quartile of the historical distribution of each ratio is rounded down to the nearest multiple of 5% as the corresponding threshold. Content units that simultaneously satisfy the conditions of continuous occurrence, consistent role status, and stable association are identified as stable semantic anchors. Centered on stable semantic anchors, related content units and their corresponding positional relationships, role succession relationships and link relationships are extracted from the semantic relationship graphs of different page versions to form historical semantic combinations. Based on version relationships, the content units corresponding to stable semantic anchors are identified in each valid page version. The role status of each content unit in the corresponding semantic relationship graph is read, along with the content units connected to it through positional, role-inheritance, or link relationships. Starting with the content unit corresponding to the stable semantic anchor, content units are extracted first along role-inheritance relationships, then along link and positional relationships. For extracted content units, the content units connected to them are extracted along the three types of relationships. The number of relationships traversed from the content unit corresponding to the stable semantic anchor to any extracted content unit does not exceed two. During the extraction process, the unit identifier, role status, page position, and page version of each content unit are recorded, along with the relationship types between content units. For relationship direction and connection order, when the same content unit is repeatedly extracted through different relationships, only one content unit record is retained, and its corresponding relationship record is also retained. The extraction results are organized according to the relationship direction. Among them, the positional relationship is arranged according to the page reading order, the role succession relationship is arranged according to the role succession direction, and the link relationship is arranged according to the link initiation direction. When multiple content units are connected by branches of the same content unit, each branch and its connection order are retained. The stable semantic anchors in the same page version, the extracted content units, the role status of each content unit, and the positional relationship, role succession relationship and link relationship between content units are combined to generate the historical semantic combination corresponding to the page version, and the stable semantic anchor identifier and page version identifier are recorded. To limit the scale of historical semantic combinations, the number of combinations is determined based on the number of extracted content units corresponding to each stable semantic anchor point in the historical normal page version, and the upper limit of the number of combinations is set to 12. Consistency screening is performed on historical semantic combinations, and the role combinations, relationship combinations, and semantic fluctuation ranges corresponding to stable semantic anchors are statistically analyzed to generate normal semantic benchmarks. Historical semantic combinations are grouped according to stable semantic anchor points. The number of content units, role status, relationship type, and relationship direction within each group are compared. Two historical semantic combinations are considered comparable if they have the same number of content units or differ by only one, and if content units can be mapped according to the same relationship direction. Role status is then compared according to the order of content unit mapping. If at least four role fields and the behavior fields of corresponding content units are consistent, the corresponding content units are considered to have consistent role status. The ratio of the number of corresponding content units with consistent role status to the total number of comparable content units is defined as the role consistency ratio. Finally, the positional relationships between corresponding content units are compared. For role-related and link relationships, when the relationship type and direction are the same, the corresponding relationship is determined to be consistent. The ratio of the number of consistent corresponding relationships to the total number of comparable relationships is determined as the consistency ratio of combined relationships. When the consistency ratio of combined roles is not lower than the role combination threshold and the consistency ratio of combined relationships is not lower than the relationship combination threshold, the corresponding historical semantic combination is retained; otherwise, it is removed as an abnormal historical semantic combination. The role combination threshold and the relationship combination threshold are determined based on the proportional distribution of the same group of historical semantic combinations. The lower quartiles of the consistency ratio of combined roles and the consistency ratio of combined relationships are read as the corresponding thresholds. The initial engineering value of the role combination threshold is set to 80%, and the initial engineering value of the relationship combination threshold is set to 75%. For the historical semantic combinations retained after filtering, the subject fields, behavior fields, object fields, intent fields, and context fields corresponding to the stable semantic anchor points and their associated content units are combined into role combinations. The occurrence frequency of each role field at each connection position is counted. For subject fields, behavior fields, and object fields, the aforementioned text semantic encoding method is used to generate field semantic vectors. The cosine similarity between semantic vectors of the same type of fields is calculated. Fields with a cosine similarity of not less than 0.88 are grouped into the same field group. For intent fields and context fields, fields belonging to the same category are grouped into the same field group. The field group with the most occurrences at each connection position is selected as the normal field at the corresponding position and combined according to the connection order of the content units to generate the normal role combination corresponding to the stable semantic anchor point. According to the connection order of content units, extract the relationship type and relationship direction in each historical semantic combination after filtering to form a relationship arrangement record. Count the number of times the same relationship type, relationship direction and connection position are repeated. The relationship record with the most occurrences in each connection position is determined as a normal relationship and combined into a normal relationship combination according to the connection order. Each historical semantic combination after filtering is compared with normal role combinations and normal relationship combinations. The cosine similarity of the subject, behavior, and object fields is subtracted from the cosine similarity of the subject, behavior, and object fields, respectively, as the deviation value for the corresponding field. The category difference encoding results of the intent and context fields are also used as the deviation values ​​for the corresponding fields. Specifically, when the categories are the same, the deviation value for the corresponding field is recorded as 0; when the categories are different, it is recorded as 1; when a field is missing or cannot be established, the deviation value for the corresponding field is recorded as 1. The average of the five field deviation values ​​for each content unit is taken, and the average result of all comparable content units is averaged again to generate the role deviation degree. The positional relationships, role succession relationships, and link relationships between content units in the historical semantic combinations are compared with the relationship type and direction of the corresponding connection positions in the normal relationship combinations. Relationships that exist in a relation combination but not in a historical semantic combination are identified as missing relation types. Relationships with the same type but opposite starting and ending directions are identified as changes in relation direction. Relationships with the same content units but different positions in the connection order are identified as changes in connection position. The number of missing relation types, changes in relation direction, and changes in connection position are divided by the total number of relations in a normal relation combination to generate the proportion of missing relations, the proportion of changes in direction, and the proportion of changes in position. The average of the three proportions is used to generate the degree of relation deviation. Then, the degree of deviation of roles and the degree of deviation of relations are normalized and summed to generate the semantic deviation value of each historical semantic combination. The semantic deviation values ​​are arranged from smallest to largest, and the numerical range between the 5th percentile and the 95th percentile is determined as the semantic fluctuation range. The stable semantic anchor identifier, normal role combination, normal relationship combination, and semantic fluctuation range are combined into the baseline record of the corresponding stable semantic anchor. The number of valid historical semantic combinations and page version range used to generate the baseline record are recorded to generate the normal semantic baseline.

[0022] In this embodiment, the generation of combined risk residuals and candidate risk paths includes: Starting with the content unit corresponding to the stable semantic anchor point, the content units are sequentially associated along the positional relationship, role succession relationship and link relationship in the semantic relationship graph to generate candidate semantic paths; The content units corresponding to each stable semantic anchor in the semantic relationship graph of the current page version are used as the starting point of the path. The connected content units are read sequentially along the relationship direction from the starting point of the path. When a content unit connects to multiple subsequent content units, path branches are formed respectively. When the same content unit already exists in the current path, the extension along the corresponding branch is stopped to avoid the formation of a circular path. The upper limit of the path length is determined according to the 90th percentile of the number of relationships contained in the path corresponding to the stable semantic anchor in the historical normal page version, and is limited to 3 to 8 relationships. The upper limit of the number of path branches of a single content unit is determined according to the 95th percentile of the number of node branches in the historical normal page version. The path starting point, the content units read sequentially, the relationship type, the relationship direction, and the connection order are combined to generate candidate semantic paths. Pass and update the role status according to the content unit order in the candidate semantic path, and generate the current semantics by combining the relationship type and relationship direction; The system reads the role status of the starting point of the candidate semantic path and uses it as the initial role status. Then, it reads the role status of subsequent content units one by one according to the connection order in the path. When there is a role succession relationship between adjacent content units, the system updates the main field, behavior field, and object field according to the corresponding continuation reference, supplement, or limitation status. Specifically, if the subsequent content unit does not repeat the recorded fields but has formed a clear succession, the corresponding fields of the previous content unit are used. The conditions, ranges, or results added by the subsequent content unit are merged into the corresponding fields. When there is a link relationship between adjacent content units, the system retains the role status of the link initiating content unit and adds the role status and page context of the link target. If no role succession relationship is established at the same time, the main body, behavior, or object of the link initiating content unit is not automatically assigned to the link target. When there is a positional relationship between adjacent content units, the system arranges the role status according to the page reading order and does not perform field inheritance. Each time a content unit is added, the system updates the current role combination and the current relationship combination and records the current number of content units, the number of relationships, and the deduction order. The final current role combination, current relationship combination, and deduction order are combined to form the current semantics of the candidate semantic path. The current semantics are compared with the normal role combinations, normal relationship combinations and semantic fluctuation range in the corresponding normal semantics benchmark to generate role deviation residuals, relationship deviation residuals and semantic fluctuation out-of-bounds amounts, and then combined to generate combined risk residuals. For role deviation residuals, based on stable semantic anchor point identifiers and connection order, the current role combination is mapped to the normal role combination in the normal semantic benchmark. For subject field, behavior field, object field, intent field, and context field, the corresponding field deviation values ​​are generated using the aforementioned method and weighted and summarized. Then, the average value is taken for all content units in the candidate semantic path to generate role deviation residuals with values ​​ranging from 0 to 1. For relation deviation residuals, based on connection order, the current relation combination is mapped to the normal relation combination in the normal semantic benchmark. The aforementioned method is used to generate the proportion of missing relations, the proportion of changes in relation type, the proportion of changes in relation direction, and the proportion of changes in connection position. The weighted summation generates relational deviation residuals ranging from 0 to 1. For semantic fluctuation out-of-bounds amounts, the role deviation residuals and relational deviation residuals are added together to obtain the current semantic deviation value. The semantic fluctuation range in the normal semantic benchmark is read. When the current semantic deviation value is within the semantic fluctuation range, the semantic fluctuation out-of-bounds amount is recorded as 0. When the current semantic deviation value is higher than the upper boundary of the semantic fluctuation range, the difference between the current semantic deviation value and the upper boundary is determined as the semantic fluctuation out-of-bounds amount. The semantic fluctuation out-of-bounds amount is restricted to a range of 0 to 1, and any part exceeding 1 is recorded as 1. The weighted summation of the role deviation residuals, relational deviation residuals, and semantic fluctuation out-of-bounds amounts yields the combined risk residual. The determination of the combined weights specifically includes: when the system runs for the first time, initial combined weights are configured for role deviation residuals, relationship deviation residuals, and semantic fluctuation out-of-bounds amounts, respectively, set to 0.50, 0.30, and 0.20. The monitoring and early warning records that have been reviewed and processed are read. Based on the finally confirmed risk evidence and the objects of processing, each monitoring and early warning record is divided into role semantic abnormality records, relationship structure abnormality records, or semantic fluctuation out-of-bounds records. The proportion of each type of record in the valid monitoring and early warning records is calculated. When the number of newly added valid monitoring and early warning records reaches the weight update number, the corresponding combined weights are updated using the proportion of each type of record. The weight update number is determined based on the number of valid early warnings on the website per unit time. A weight update is performed once for every fifty newly added valid monitoring and early warning records. Based on the residual sequence formed by adding content units sequentially with the combined risk residual, extract the content units that continuously exceed the risk boundary and their corresponding relationships to generate candidate risk paths. Each time a content unit is added to a candidate semantic path, a new combined risk residual is generated. The combined risk residuals are arranged according to the order in which the content units are added, forming a residual sequence. The position where the combined risk residual first exceeds the risk boundary is determined from the residual sequence. When the combined risk residual exceeds the risk boundary for two consecutive derivation sequences, the content unit that first exceeds the risk boundary, its preceding content unit, and the relationship between the two are determined as the starting part of the candidate risk path. The content units and corresponding relationships where the combined risk residual exceeds the risk boundary are continued to be included along the path. When the combined risk residual of a certain derivation sequence exceeds 25% of the risk boundary, that is, when the combined risk residual is not less than 1.25 times the risk boundary, even if there are no two consecutive boundary crossings, the corresponding content unit, the preceding content unit, and their relationship are determined as the candidate risk path. The risk boundary is determined according to the distribution of combined risk residuals in the historical normal page version. The 95th percentile of the combined risk residuals of the historical normal candidate semantic path is read and rounded up to the nearest 0.01.

[0023] In this embodiment, the generation of implicit portfolio risk includes: The content units in the candidate risk paths are deleted, replaced with content units of the same role in the normal semantic benchmark, and the role connection relationship in the candidate risk paths is broken. Counterfactual semantics are then regenerated according to the connection order of the candidate risk paths. For content unit deletion, the current content unit and its direct connection relationship are removed from the candidate risk path, the original connection order of the remaining content units is retained, and no new role succession relationship is automatically established between the content units before and after the current content unit. When the candidate risk path is divided into two path segments after the current content unit is deleted, the semantics are regenerated according to the original relationship direction of the two path segments respectively, and the semantic results of the two path segments are used together as the deletion counterfactual semantics. For same-role replacement, based on the connection position of the current content unit in the candidate risk path, read the normal role combination at the corresponding position in the normal semantic benchmark, and filter the same-role content units from the historical semantic combinations used to generate the normal semantic benchmark. Content units with the same content type, the same intent field category, the same context field category, and located in the same connection position are identified as same-role content units. When there are multiple same-role content units, they are sorted from high to low according to their occurrence frequency in the historical semantic combinations. The content unit with the most occurrence frequency is selected, and the role state of the current content unit is replaced by the role state of the selected same-role content unit. The connection position and non-role inheritance relationship of the current content unit in the candidate risk path remain unchanged, and the candidate risk path after replacement is generated. When the role inheritance relationship is broken, the role inheritance relationship between the current content unit and the previous content unit and the next content unit is read respectively, and the role inheritance relationship is broken one by one. The corresponding content unit and its position relationship and link relationship are retained. After the role inheritance relationship is broken, the next content unit no longer inherits the main field, behavior field or object field of the previous content unit, and only participates in counterfactual semantic generation based on the role state of the next content unit itself. The above-mentioned content unit deletion, role replacement, and role connection disconnection are performed sequentially on each content unit. Only one content unit or one role connection is changed each time, while the remaining content units and relationships remain unchanged. According to the connection order in the candidate risk path after intervention, the role status of the remaining content units or the replaced content units is read sequentially. For the role connection that still exists, the role fields are passed according to the status of continued reference, supplementation, or limitation. For the role connection that has been disconnected, the passing of the corresponding role fields is stopped. For positional relationships and link relationships, the original processing method is maintained to generate the role combination and relationship combination after intervention. The role combination, relationship combination, and connection order after intervention are combined to generate the corresponding counterfactual semantics. Each counterfactual semantic is compared with the normal semantic benchmark to generate counterfactual residuals, and the amount of residual reduction corresponding to the intervention is determined based on the combined risk residuals and counterfactual residuals. Using the same generation method as the combined risk residual, the counterfactual semantics are compared with the normal role combination, normal relationship combination and semantic fluctuation range in the normal semantic benchmark to generate counterfactual residuals. The combined risk residuals of the candidate risk paths before intervention are subtracted from the corresponding counterfactual residuals to generate the residual reduction amount. When the counterfactual residuals are not lower than the combined risk residuals, the residual reduction amount is recorded as 0. The residual reduction amount of content unit deletion, the residual reduction amount of same role replacement and the residual reduction amount of role succession relationship disconnection are recorded respectively, and each residual reduction amount is normalized to a value range of 0 to 1. Based on the amount of residual reduction from each intervention, risk contribution units are determined, and risk contribution units are combined with the corresponding roles that caused the residual reduction to form risk evidence. For each content unit, read its deletion residual decrease, same role replacement residual decrease, and role succession relationship disconnection residual decrease, and determine the maximum value of the content unit as the risk contribution value of the corresponding content unit. When the risk contribution value of the content unit is not lower than the contribution boundary, it is determined as a risk contribution unit. The contribution boundary is determined based on the counterfactual intervention results of the historical normal candidate semantic path. The same three types of single intervention are performed on the historical normal candidate semantic path, the residual decrease is counted, and the 95th percentile of the residual decrease distribution is rounded up to the nearest 0.01 to determine the contribution boundary. The role relationship with the largest residual decrease is identified as the role relationship corresponding to the risk contribution unit. The risk contribution unit identifier, role status, corresponding role relationship, intervention type, combined risk residual, counterfactual residual, and residual decrease are combined to form risk evidence. When multiple role relationships connected to a risk contribution unit have the same residual decrease, the role relationship that enters the risk contribution unit along the candidate risk path deduction direction is selected first. If there is no entry direction relationship, the role relationship that leaves the direction is selected. For adjacent content units that have not individually reached the contribution boundary, joint intervention is performed. When the residual decrease corresponding to the joint intervention reaches the combination boundary and exceeds the sum of the residual decreases of each individual intervention, the implicit combination risk is determined. From content units whose risk contribution value is lower than the contribution boundary, select content unit pairs that are directly connected by role inheritance relationship or whose interval in the candidate risk path is no more than one content unit. Perform joint deletion and joint same role replacement respectively. Subtract the counterfactual residual after joint intervention from the combined risk residual before joint intervention to generate the joint residual reduction. Take the larger value of the two types of joint residual reduction and subtract the sum of the maximum single residual reduction of each of the two content units from the larger value to generate the combined increment. When the larger value of the joint residual reduction of the two content units reaches the combined boundary and the combined increment reaches the combined increment boundary, it is determined that the two content units constitute implicit combined risk. For the combined boundary and the combined increment boundary, historical candidate semantic paths that have been verified to not contain content security risks are selected. For content units that meet the scope of joint intervention, joint deletion and joint same-role replacement are performed. The joint residual decrease and the corresponding combined increment are calculated respectively to form a sample set of joint residual decrease and a sample set of combined increment. The median and absolute median difference of the two sample sets are calculated respectively. The sum of the median of the joint residual decrease and three times the absolute median difference is determined as the combined boundary. The sum of the median of the combined increment and three times the absolute median difference is determined as the combined increment boundary. The obtained values ​​are rounded up to the nearest 0.01.

[0024] In this embodiment, the generation of evidence migration state and risk evolution state includes: Based on the version relationship, stable semantic anchors in adjacent page versions are matched. Using the matched stable semantic anchors as the alignment benchmark, the semantic relationship graph of adjacent page versions is aligned according to the connection path and structural position. Read stable semantic anchors from adjacent page versions. Based on the maintain, replace, or migrate relationships in the version relationship, match the corresponding stable semantic anchors in the previous and next page versions to generate anchor pairs. Configure the same anchor alignment identifier for the same anchor pair. Starting from the stable semantic anchor in the anchor pair, read content units along the positional relationship, role succession relationship, and link relationship in the corresponding semantic relationship graph. For each content unit, determine the shortest connection path from the stable semantic anchor to the content unit and record the number of relationships, relationship type order, and relationship direction order contained in the connection path. Read the structural path of each content unit in the page structure and decompose the structural path into page area, structural level, parent node identifier, and sibling arrangement number. Combine the content unit identifier, anchor alignment identifier, number of relationships, relationship type order, relationship direction order, and structural path to generate the content unit. For content units on previous and subsequent page versions with the same anchor alignment identifier, alignment relationships are established based on the maintain, replace, or migrate records in the version relationship. For content units that do not correspond to a version, their connection paths and structural positions are compared. When the difference in the number of relationships does not exceed one, the first relationship type in the relationship type order is the same, the relationship direction is consistent, the page area is the same, and the difference in structural level does not exceed two levels, the corresponding content unit is determined as a candidate alignment unit. When a content unit corresponds to multiple candidate alignment units, the candidate alignment units with smaller differences in the number of relationships, more items with the same relationship type order, smaller differences in structural level, and smaller differences in the same-level arrangement number are selected in sequence. The content unit identifier of the previous page version, the content unit identifier of the next page version, the anchor alignment identifier, the difference in connection path, the difference in structural position, and the alignment status are combined to generate the semantic relationship graph alignment result. Based on the version relationship and alignment results, risk contribution units in adjacent page versions are matched, and the connection endpoints and relationship directions of the role undertaking relationship corresponding to the risk contribution units are verified to establish cross-version correspondence. For risk contribution units recorded as maintained, replaced, or migrated in the version relationship, the corresponding content units in the next page version are read. When the corresponding content units are also identified as risk contribution units, a risk contribution unit correspondence relationship is established, and maintained, replaced, or migrated is determined as the unit correspondence type. When the risk contribution units in the current page version fail to match successfully through the version relationship, risk contribution units in the next page version with the same anchor point alignment identifier are read as candidate units according to the semantic relationship graph alignment results. When the risk contribution units in the current page version have the same content type as each candidate unit, and at least four of the main field, behavior field, object field, intent field, and context field are consistent, and the behavior field is consistent, the candidate units are determined to meet the role correspondence conditions. For candidate units that meet the role correspondence conditions, the differences in connection paths and structural positions in the semantic relationship graph alignment results are further read. When the difference in the number of relationships does not exceed one, the first relationship type is the same, the relationship direction is consistent, the page area is the same, and the difference in structural level does not exceed two levels, a risk contribution unit correspondence relationship is established, and the unit correspondence type is determined as alignment matching. Read the role inheritance relationships corresponding to the two risk contribution units that form a risk contribution unit relationship, and determine the starting and ending content units of each role inheritance relationship. When the starting and ending content units of the role inheritance relationship in the current page version correspond to the starting and ending content units of the role inheritance relationship in the next page version, the relationship verification result is determined as direction maintenance. When the starting and ending content units of the role inheritance relationship in the current page version correspond to the ending and starting content units of the role inheritance relationship in the next page version, the relationship verification result is determined as direction maintenance. If the direction is determined to be reversed, when both connection endpoints form corresponding content units, but there is no role inheritance relationship between the corresponding endpoints in the later page version, the relationship verification result is determined to be a broken relationship. When a risk contribution unit forms a corresponding unit, but the role inheritance relationship connected to it in the later page version uses a new connection endpoint, the relationship verification result is determined to be an endpoint change, and the original connection endpoint and the new connection endpoint are recorded. When a risk contribution unit in the later page version adds a role inheritance relationship, and there is no role inheritance relationship corresponding to the connection endpoint in the previous page version, the relationship verification result is determined to be a new relationship. Combine the previous page version identifier, the next page version identifier, the previous risk contribution unit identifier, the next risk contribution unit identifier, the unit corresponding type, the risk contribution value before and after, the role succession relationship identifier before and after, the connection endpoint corresponding result, the relationship direction verification result and the matching status to establish a cross-version correspondence relationship. Based on the cross-version correspondence, the page location, structural path and corresponding role inheritance relationship of the corresponding risk contribution unit are compared to generate the evidence migration status. Under the same page viewport size, read the center horizontal coordinate and center vertical coordinate of the area where the risk contribution unit is located, divide them by the effective page width and the effective page height respectively to generate the horizontally normalized position and the vertically normalized position, calculate the difference in the horizontally normalized position and the difference in the vertically normalized position of the corresponding risk contribution unit in the previous and next page versions, and generate the page position change amount with a value range of 0 to 1 based on the square root of the sum of the squares of the two differences. The structural path of the risk contribution unit is divided into a node sequence according to the page structure hierarchy. The node sequence includes node type, parent node identifier and sibling arrangement number. Starting from the starting level of the structural path, the node sequences in the previous and next page versions are compared level by level. The number of changes in node type, parent node, level increase, level decrease and sibling arrangement number is counted. The number of structural levels that have changed is divided by the maximum number of levels in the previous and next structural paths to generate a structural path change amount with a value ranging from 0 to 1. When the previous and next structural paths are exactly the same, the structural path change amount is recorded as 0. Read the relationship direction verification results in the cross-version correspondence, and determine the role acceptance relationship change status of the corresponding risk contribution unit by keeping the direction, reversing the direction, changing the endpoint, breaking the relationship, or adding the relationship. When the page identifiers and page areas of the current and subsequent risk contribution units are the same, and the changes in page position do not exceed the position change boundary and the changes in structural path do not exceed the structural change boundary, the content migration type is determined to be "in-situ retention". When the page identifiers of the current and subsequent risk contribution units are the same, but the page area changes, the changes in page position exceed the position change boundary, the changes in structural path exceed the structural change boundary, or the page reading order changes, the content migration type is determined to be "intra-page migration". When the page identifiers of the current and subsequent risk contribution units are different, and the unit corresponding type in the cross-version correspondence is migration or alignment matching, the content migration type is determined to be "cross-page migration". The position change boundary and the structural change boundary are determined by the fact that no content security risks have occurred after review, and the risk contribution unit forms a historical adjacent page version that is maintained or replaced. Specifically, the 95th percentile of the historical distribution of page position changes is rounded up to the nearest 0.01 to determine the position change boundary, and the 95th percentile of the historical distribution of structural path changes is rounded up to the nearest 0.05 to determine the structural change boundary. Compare the existence status, quantity, and risk contribution value of the corresponding risk contribution units in adjacent page versions, and generate the risk evolution status by combining the evidence migration status. For risk contribution units that establish cross-version correspondence, their existence status is determined as "persistent". For risk contribution units that only exist in the previous page version and do not establish cross-version correspondence in the next page version, their existence status is determined as "disappeared". For risk contribution units that only exist in the next page version and do not establish cross-version correspondence in the previous page version, their existence status is determined as "new". The number of persistent, disappeared and new risk contribution units in each group are counted respectively, and the corresponding number, number of disappeared and number of new are generated. For risk contribution units that correspond to different versions, the risk contribution value of the later page version is subtracted from the risk contribution value of the previous page version to generate the risk contribution change. When the risk contribution change is greater than the risk contribution value change boundary, it is determined as an enhanced contribution. When it is less than the negative value of the risk contribution value change boundary, it is determined as a weakened contribution. Otherwise, it is determined as a stable contribution. The risk contribution value change boundary is determined based on the repeated collection versions where the page content has not changed. The absolute value of the difference in risk contribution values ​​of the corresponding risk contribution units is calculated, and its 99th percentile is rounded up to the nearest 0.01 to determine the risk contribution value change boundary. For the survival evolution type, when there is no risk contribution unit in the previous page version but there is in the next page version, the survival evolution type is determined to be risk addition; when there is in the previous page version but there is not in the next page version, it is determined to be risk decline; when there are corresponding risk contribution units in both the previous and next page versions, it is determined to be risk persistence. For the scale evolution type, when the number of risk contribution units in the next page version increases, the scale evolution type is determined to be risk diffusion; when the number decreases, it is determined to be risk convergence; when the number is the same but there are both additions and disappearances, it is determined to be risk replacement. For intensity evolution type, when the number of contribution enhancement units is greater than the number of contribution reduction units, the intensity evolution type is determined to be risk enhancement; when the number of contribution reduction units is greater than the number of contribution enhancement units, it is determined to be risk reduction; when all corresponding units are contribution stable, it is determined to be intensity maintenance. Read the evidence migration status of the corresponding risk contribution unit. When there is intra-page migration, cross-page migration, or change in role inheritance relationship, determine the migration evolution type as risk transfer. Combine the survival evolution type, scale evolution type, intensity evolution type, and migration evolution type to generate the risk evolution status, and record the previous and next page version identifiers, corresponding quantities, new quantities, disappearance quantities, and changes in risk contribution.

[0025] In this embodiment, the updating of stable semantic anchors, normal semantic benchmarks, and evidence handling status includes: The strength of evidence is determined based on risk evidence, the combination risk is marked based on implicit combination risks, and monitoring and early warning results and warning levels are generated by combining the evidence migration status and risk evolution status. Configure an early warning identifier for each implicit combined risk and risk evidence. For a single risk evidence, select the risk contribution value corresponding to the risk contribution unit as the evidence strength. When the same risk evidence contains multiple risk contribution units, select the largest risk contribution value. For implicit combined risks, record the joint residual decrease and the combined increment, and mark the combined risk as valid. When there is no implicit combined risk, mark the combined risk as invalid. Combine the early warning identifier, page identifier, page version identifier, risk contribution unit identifier, corresponding role inheritance relationship, evidence strength, combined risk identifier, evidence migration status and risk evolution status to generate monitoring and early warning results. The warning levels include general warning, key warning, and emergency warning, and are determined in descending order. When the same monitoring and warning result meets multiple level conditions at the same time, the higher warning level is adopted. When the evidence strength is higher than the contribution boundary but lower than the combination boundary, there is no implicit combination risk, the evidence migration status is in situ retention, and the risk evolution status does not include risk diffusion, risk enhancement, or risk transfer, it is determined as a general warning. When the evidence strength is higher than the combination boundary, or there is an implicit combination risk, or the risk evolution status includes risk diffusion, risk enhancement, or risk transfer, it is determined as a key warning. When the evidence strength is more than twice the contribution boundary, or the decrease in joint residual is higher than the sum of the combination boundary and the combination increment boundary, or the evidence migration status is cross-page migration and the risk evolution status includes risk diffusion or risk enhancement, it is determined as an emergency warning. According to the warning level, the monitoring and warning results are written into the corresponding review queue. Based on the review conclusion, the content is corrected, the role assignment relationship is corrected, the page is isolated and the warning is lifted, and the handling record is generated. For review, the review period for general early warnings shall not exceed one routine inspection cycle, with an initial engineering value of 24 hours; the review period for key early warnings shall not exceed one duty cycle, with an initial engineering value of 4 hours; and the review period for emergency early warnings shall not exceed the alarm confirmation cycle, with an initial engineering value of 30 minutes. Key early warnings and emergency early warnings shall be reviewed independently by two review terminals. When the two review conclusions are inconsistent, the corresponding monitoring and early warning results shall be transferred to the upgrade review queue. For handling, when the review conclusion is risk confirmation, the handling object is determined based on the risk evidence. When the risk source is a content unit, content modification or content unit removal is performed. When the risk source is a role inheritance relationship, relationship modification is performed. When the risk involves cross-page migration, risk spread, or emergency warning, link disabling, page isolation, or version rollback is performed. When the review conclusion is normal confirmation, the corresponding monitoring and warning results are lifted, and the warning identifier, handling object, handling action, operating terminal, operator identifier, handling start time, handling completion time, and page content verification value after handling are recorded to generate a handling record. The evidence handling status is updated based on the review conclusion, handling record and post-handling verification results. The stable semantic anchor and normal semantic benchmark are updated based on the content units that are reviewed as normal and continuously verified as stable. Content units that are reviewed as risk and their corresponding page versions are excluded from the normal samples. Read the review conclusions, handling records, and post-handling verification results corresponding to the monitoring and early warning results. When the review conclusion is normal, update the evidence handling status to normal release. When the review conclusion is risky and no corresponding risk evidence is generated again after handling, update it to handled. When corresponding risk evidence is generated again after handling, update it to risk recurrence. When the review has not been completed, keep it as pending review. For content units that are reviewed as normal, when five consecutive valid page versions remain, the role status and corresponding relationship meet the stability conditions, and no monitoring and early warning results are generated again, add the corresponding page version to the normal sample. For content units that are reviewed as risky, exclude their corresponding role inheritance relationship and page version from the normal sample. When the content unit has been identified as a stable semantic anchor, cancel its stable semantic anchor mark. When 20 new valid page versions are added to the normal sample, or when an existing stable semantic anchor is canceled, use the updated normal sample to re-select stable semantic anchors and update the normal semantic benchmark.

[0026] A website content security monitoring system based on multidimensional semantic analysis includes: The data acquisition module is used to collect and preprocess multiple versions of website content and related content, and generate content units and version relationships; The semantic graph module is used to generate role states based on content units and construct a semantic relationship graph based on the positional relationships, role succession relationships, and link relationships of content units. The benchmark generation module is used to filter stable semantic anchors based on content units, role status, and version relationships, and generate normal semantic benchmarks based on stable semantic anchors and semantic relationship graphs. The forward inference module is used to sequentially associate content units based on the semantic relationship graph and perform forward inference to generate the current semantics, compare the current semantics with the normal semantics benchmark, generate combined risk residuals and determine candidate risk paths; The counterfactual attribution module is used to perform content unit deletion, role replacement, and role connection disconnection on candidate risk paths, generate counterfactual semantics, compare the counterfactual semantics with the normal semantic benchmark, generate counterfactual residuals, compare the combined risk residuals with the counterfactual residuals, generate residual reduction, determine risk contribution units according to residual reduction, combine risk contribution units and corresponding role connection relationships into risk evidence, and determine implicit combined risks. The evolution tracking module is used to align the semantic relationship graph of adjacent versions with stable semantic anchors, establish cross-version correspondences of risk contribution units and corresponding role inheritance relationships, and generate evidence migration status and risk evolution status. The early warning feedback module is used to generate monitoring and early warning results based on implicit combined risks, risk evidence, evidence migration status and risk evolution status, review and handle the monitoring and early warning results, and provide feedback to update stable semantic anchors, normal semantic benchmarks and evidence handling status.

[0027] Example 1: To verify the feasibility of this invention in practice, it was applied to a website content security monitoring scenario for a comprehensive information service agency in a provincial capital city in East China. The monitoring scope included a main portal site, three business sub-sites, and their associated pages, covering a total of 480 accessible pages, of which 72 pages were updated frequently. A total of 3260 valid page versions and 4680 page relationships were generated. The original system used keyword rules and single-page text classification to judge scattered expressions such as "free trial," "submit your mobile phone number to activate," and "automatic renewal after expiration" separately. Individual content did not exceed the rule threshold, but when combined, there was a problem of separation between free promises, direct registration, and charging conditions. It was also difficult to continuously track the charging instructions after they were moved to the collapsed area or other pages. This invention performs character standardization, template removal, and structural parsing on the page, dividing the title, body text, buttons, collapsed instructions, link text, and comments into content units. On average, a single page formed 18 content units, frequently updated pages averaged 27, and the longest rule page had 96. The system generates role states from subjects, behaviors, objects, intentions, and contexts, and constructs a semantic relationship graph based on these three types of relationships. Using the 20 most recent valid page versions as observation windows, content units with a continuous occurrence rate of no less than 80%, a maximum consecutive absence of no more than two versions, a field semantic similarity of no less than 0.88, and a stable association rate of no less than 75% are identified as stable semantic anchors, and normal semantic benchmarks are generated accordingly.

[0028] In the semantic path containing the free commitment, registration entry, and renewal instructions, the system forward deduces the role deviation residual, relationship deviation residual, and semantic fluctuation overstepping limit. These are weighted at 0.5, 0.3, and 0.2 respectively, generating a combined risk residual of 0.21, which is higher than the risk boundary, thus forming a candidate risk path. After deleting the registration guidance content, replacing it with the same role, and breaking the role inheritance relationship, the residual decreases are 0.10, 0.15, and 0.08 respectively. The maximum value of 0.15 exceeds the contribution boundary, and the system generates corresponding risk evidence. The individual residual decreases for the free commitment and renewal instructions are 0.07 and 0.06 respectively. The residual decrease after joint replacement is 0.2, and the combined increment is 0.07, exceeding the combined boundary and combined increment boundary respectively, thus being identified as implicit combined risk.

[0029] In subsequent page versions, the renewal instructions were moved from the activity details page to the user agreement page. The page location change was 0.43, and the structural path change was 0.31, both exceeding the corresponding change boundaries. The system determined this to be a cross-page migration. The number of risk contribution units under the same anchor point increased from 3 to 5. Among them, two risk contribution values ​​increased from 0.14 and 0.16 to 0.22 and 0.24, and the risk evolution status was determined to be risk persistence, risk diffusion, risk enhancement, and risk transfer. After review, the implementer added a renewal prompt to the activity entry, restored the fee instructions to the directly visible area, and changed the registration button to activate after confirming the fee instructions. The combined risk residual after the handling decreased to 0.10, no corresponding candidate risk path was formed again, and the evidence handling status was updated to handled.

[0030] To facilitate the evaluation of the implementation effect of the present invention, samples of the same caliber within the same monitoring range and manually verified were selected for comparison. The same page version, content division and verification criteria were used for each method. The comparison data are shown in Table 1.

[0031] Table 1. Comparison of comprehensive performance of multidimensional semantic website content security monitoring methods with the same caliber.

[0032] As shown in Table 1, the overall recognition accuracy of the method of this invention reaches 95.6%, which is 14.0 percentage points higher than the traditional keyword rule method and 4.4 percentage points higher than the graph semantic association method. The recall rate of implicit combination risk reaches 91.7%, which is 43.9 and 14.8 percentage points higher than the two methods, respectively, indicating that this invention can discover implicit risks formed after combination. The cross-version migration recognition rate reaches 90.4%, which is 21.8 percentage points higher than the graph semantic association method. This is mainly due to the alignment of stable semantic anchor points, the cross-version correspondence of risk contribution units, and the joint verification of changes in page position and structural path.

[0033] The risk evidence location accuracy rate of this invention is 93.1%, with a false positive rate reduced to 3.8%. On average, only 2.1 pages need to be reviewed per warning, indicating that counterfactual intervention can locate specific content units and relationships, reducing the need to check irrelevant pages. The closed-loop effectiveness rate of the handling reaches 94.6%, which is 12.3 percentage points higher than the graph semantic association method. This is because the review conclusion can provide feedback on the updated evidence handling status, stabilize semantic anchors and normal semantic benchmarks, so that normal changes are included in the benchmark and risky versions are excluded from normal samples, thus taking into account identification accuracy, traceability and long-term adaptability.

[0034] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A website content security monitoring method based on multidimensional semantic analysis, characterized in that, include: Collect and preprocess multiple versions of website content and related content to generate content units and version relationships; Generate role states based on content units, and construct a semantic relationship graph based on the positional relationships, role succession relationships, and link relationships of content units; Stable semantic anchors are selected based on content units, role status, and version relationships, and normal semantic benchmarks are generated based on stable semantic anchors and semantic relationship graphs. Based on the semantic relationship graph, content units are sequentially associated and forward inference is performed to generate the current semantics. The current semantics are compared with the normal semantics benchmark to generate combined risk residuals and determine candidate risk paths. For candidate risk paths, content unit deletion, role replacement, and role connection disconnection are performed respectively to generate counterfactual semantics. The counterfactual semantics are compared with the normal semantics benchmark to generate counterfactual residuals. The combined risk residuals and counterfactual residuals are compared to generate residual reduction. Risk contribution units are determined according to residual reduction. Risk contribution units and corresponding role connection relationships are combined into risk evidence, and implicit combined risks are determined. By aligning the semantic relationship graphs of adjacent versions with stable semantic anchors, cross-version correspondences of risk contribution units and corresponding role inheritance relationships are established, and evidence migration status and risk evolution status are generated. Monitoring and early warning results are generated based on implicit combined risks, risk evidence, evidence migration status, and risk evolution status. The monitoring and early warning results are reviewed and processed, and feedback is provided to update stable semantic anchors, normal semantic benchmarks, and evidence processing status.

2. The website content security monitoring method based on multidimensional semantic analysis according to claim 1, characterized in that, The website's multiple versions of content include the page content and its corresponding version records formed at different collection times of the same website page. The associated content includes page content that has a same domain reference, page jump, content reference or direct link relationship with the page to be monitored, as well as the link relationship between the associated pages and the page to be monitored. The preprocessing includes character encoding unification, whitespace character standardization, mark structure correction, invalid node deletion, duplicate page template removal and page structure parsing.

3. The website content security monitoring method based on multidimensional semantic analysis according to claim 1, characterized in that, The generation of the semantic relationship graph includes: Semantic parsing is performed on content units to identify subjects, behaviors, objects, intentions, and contexts, and to generate role states; Determine the positional relationship based on the structural path, page position, and arrangement order of the content unit; determine the link relationship based on the link target corresponding to the content unit. Perform role continuity and contextual conflict checks on content units that have positional or link relationships, and establish role succession relationships; A semantic relationship graph is constructed using content units as nodes, role status as node attributes, and positional relationships, role succession relationships, and link relationships as directed edges.

4. The website content security monitoring method based on multidimensional semantic analysis according to claim 1, characterized in that, The generation of the normal semantic benchmark includes: Associate the corresponding records of the same content unit in different page versions along the version relationship, and select stable semantic anchors based on the continuous occurrence status of the content unit, the consistency of the role status, and the stability of the association relationship in the semantic relationship graph. Centered on stable semantic anchors, related content units and their corresponding positional relationships, role succession relationships and link relationships are extracted from the semantic relationship graphs of different page versions to form historical semantic combinations. Consistency screening is performed on historical semantic combinations, and the role combinations, relationship combinations, and semantic fluctuation ranges corresponding to stable semantic anchors are statistically analyzed to generate normal semantic benchmarks.

5. The website content security monitoring method based on multidimensional semantic analysis according to claim 1, characterized in that, The generation of the combined risk residual and candidate risk path includes: Starting with the content unit corresponding to the stable semantic anchor point, the content units are sequentially associated along the positional relationship, role succession relationship and link relationship in the semantic relationship graph to generate candidate semantic paths; Pass and update the role status according to the content unit order in the candidate semantic path, and generate the current semantics by combining the relationship type and relationship direction; The current semantics are compared with the normal role combinations, normal relationship combinations and semantic fluctuation range in the corresponding normal semantics benchmark to generate role deviation residuals, relationship deviation residuals and semantic fluctuation out-of-bounds amounts, and then combined to generate combined risk residuals. Based on the residual sequence formed by adding content units sequentially with the combined risk residual, extract the content units that continuously exceed the risk boundary and their corresponding relationships to generate candidate risk paths.

6. The website content security monitoring method based on multidimensional semantic analysis according to claim 1, characterized in that, The generation of the implicit portfolio risk includes: The content units in the candidate risk paths are deleted, replaced with content units of the same role in the normal semantic benchmark, and the role connection relationship in the candidate risk paths is broken. Counterfactual semantics are then regenerated according to the connection order of the candidate risk paths. Each counterfactual semantic is compared with the normal semantic benchmark to generate counterfactual residuals, and the amount of residual reduction corresponding to the intervention is determined based on the combined risk residuals and counterfactual residuals. Based on the amount of residual reduction from each intervention, risk contribution units are determined, and risk contribution units are combined with the corresponding roles that caused the residual reduction to form risk evidence. For adjacent content units that have not individually reached the contribution boundary, joint intervention is performed. When the residual decrease corresponding to the joint intervention reaches the combination boundary and exceeds the sum of the residual decreases of each individual intervention, the implicit combination risk is determined.

7. The website content security monitoring method based on multidimensional semantic analysis according to claim 1, characterized in that, The generation of the evidence migration state and risk evolution state includes: Based on the version relationship, stable semantic anchors in adjacent page versions are matched. Using the matched stable semantic anchors as the alignment benchmark, the semantic relationship graph of adjacent page versions is aligned according to the connection path and structural position. Based on the version relationship and alignment results, risk contribution units in adjacent page versions are matched, and the connection endpoints and relationship directions of the role undertaking relationship corresponding to the risk contribution units are verified to establish cross-version correspondence. Based on the cross-version correspondence, the page location, structural path and corresponding role inheritance relationship of the corresponding risk contribution unit are compared to generate the evidence migration status. Compare the existence status, quantity, and risk contribution value of the corresponding risk contribution units in adjacent page versions, and generate the risk evolution status by combining the evidence migration status.

8. A website content security monitoring method based on multidimensional semantic analysis according to claim 1, characterized in that, The updates to the stable semantic anchor, normal semantic benchmark, and evidence handling status include: The strength of evidence is determined based on risk evidence, the combination risk is marked based on implicit combination risks, and monitoring and early warning results and warning levels are generated by combining the evidence migration status and risk evolution status. According to the warning level, the monitoring and warning results are written into the corresponding review queue. Based on the review conclusion, the content is corrected, the role assignment relationship is corrected, the page is isolated and the warning is lifted, and the handling record is generated. The evidence handling status is updated based on the review conclusion, handling records, and post-handling verification results. The stable semantic anchor and normal semantic benchmark are updated based on the content units that are reviewed as normal and continuously verified as stable. Content units that are reviewed as risky and their corresponding page versions are excluded from the normal samples.

9. A website content security monitoring system based on multidimensional semantic analysis, comprising executing the website content security monitoring method based on multidimensional semantic analysis as described in any one of claims 1 to 8, characterized in that, include: The data acquisition module is used to collect and preprocess multiple versions of website content and related content, and generate content units and version relationships; The semantic graph module is used to generate role states based on content units and construct a semantic relationship graph based on the positional relationships, role succession relationships, and link relationships of content units. The benchmark generation module is used to filter stable semantic anchors based on content units, role status, and version relationships, and generate normal semantic benchmarks based on stable semantic anchors and semantic relationship graphs. The forward inference module is used to sequentially associate content units based on the semantic relationship graph and perform forward inference to generate the current semantics, compare the current semantics with the normal semantics benchmark, generate combined risk residuals and determine candidate risk paths; The counterfactual attribution module is used to perform content unit deletion, role replacement, and role connection disconnection on candidate risk paths, generate counterfactual semantics, compare the counterfactual semantics with the normal semantic benchmark, generate counterfactual residuals, compare the combined risk residuals with the counterfactual residuals, generate residual reduction, determine risk contribution units according to residual reduction, combine risk contribution units and corresponding role connection relationships into risk evidence, and determine implicit combined risks. The evolution tracking module is used to align the semantic relationship graph of adjacent versions with stable semantic anchors, establish cross-version correspondences of risk contribution units and corresponding role inheritance relationships, and generate evidence migration status and risk evolution status. The early warning feedback module is used to generate monitoring and early warning results based on implicit combined risks, risk evidence, evidence migration status and risk evolution status, review and handle the monitoring and early warning results, and provide feedback to update stable semantic anchors, normal semantic benchmarks and evidence handling status.

Images