An Internet information processing method, system, storage medium and program product

Abstract

An Internet information processing method, system, storage medium and program product, in the method, the access log of the first platform and the download log of the second platform are obtained, and the timestamp sequence and the device identifier set are extracted. The flow fluctuation correlation of two nodes in a preset time window is calculated; if the correlation is greater than a preset threshold, the intersection proportion of the device identifier set is further calculated. When the intersection proportion is also greater than a preset threshold, it is determined that there is a cross-domain diversion relationship between the two, and a cross-domain derivative correlation edge is established. Finally, when the resource storage node is confirmed as a violation node, the system can perform reverse tracing through the correlation edge, and accurately mark the corresponding information publishing node as a violation propagation source. The present application is used to realize unified patrol and full-link track tracing of multi-channel Internet information, thereby reducing the tracing difficulty of the violation information source and improving the efficiency of global network information governance.

Description

Technical Field

[0001] This application belongs to the field of electronic digital data processing, and in particular relates to an Internet information processing method, system, storage medium and program product. Background Technology

[0002] With the explosive growth of internet information, content compliance screening on online platforms has become a crucial aspect of information governance. Early internet information inspections relied mainly on manual verification or fixed keyword matching. This approach was not only inefficient but also limited to processing single text messages, making it difficult to handle the massive amounts of complex online information that included images, audio, video, and other non-text formats. Consequently, the inspection coverage and accuracy were both low.

[0003] The proposed technology is a deep learning-based intelligent verification method for multimodal information. This method is typically deployed on a specific, single network platform. Utilizing algorithms such as image recognition, speech-to-text conversion, and natural language processing, it can automatically parse and match features of various modalities of information, including text, images, audio, and video, generated within the platform. This improves the efficiency of verifying individual messages and, to some extent, addresses the challenge of verifying non-textual information.

[0004] In the daily scenario of cross-platform information dissemination, the publisher first generates the illegal source file on a cloud storage service, and then forwards it to mainstream social media platforms in the form of screenshots or secondary links. Although the relevant technologies deployed within the social media platform can identify and block illegal content on the platform, their processing logic relies on the internal data flow of a single platform, and can only obtain a partial slice of the information dissemination chain. As the information dissemination chain lengthens, it increases the difficulty of tracing the initial source of illegal information and reduces the completeness of the overall inspection trajectory. Summary of the Invention

[0005] This application provides an internet information processing method, system, storage medium, and program product for realizing unified inspection and full-link trajectory tracing of internet information from multiple channels, thereby reducing the difficulty of tracing the source of illegal information and improving the efficiency of overall network information governance.

[0006] In the first aspect, this application provides an Internet information processing method to obtain access behavior logs of multiple information publishing nodes in a first platform and download behavior logs of multiple resource storage nodes in a second platform;

[0007] Extract the timestamp sequence and the corresponding set of visitor device identifiers from the access behavior log; extract the timestamp sequence and the corresponding set of downloader device identifiers from the download behavior log;

[0008] For any information publishing node and any resource storage node, calculate the correlation of traffic fluctuations within a preset time window for the timestamp sequence;

[0009] If the correlation of traffic fluctuations is determined to be greater than the first preset threshold, calculate the intersection ratio of the visitor device identifier set and the downloader device identifier set;

[0010] If the intersection ratio is greater than the second preset threshold, it is determined that there is a cross-domain traffic redirection relationship between the information publishing node and the resource storage node;

[0011] Based on cross-domain traffic redirection relationships, establish cross-domain derived association edges between information publishing nodes and resource storage nodes;

[0012] In response to a resource storage node being identified as a violation node, reverse tracing is performed based on cross-domain derived association edges to mark information publishing nodes that have cross-domain derived association edges with the violation node as the source of the violation.

[0013] By adopting the above technical solution, and by acquiring the behavior logs of the information publishing node of the first platform and the resource storage node of the second platform, extracting the timestamp sequence and device identifier set, and calculating the correlation of traffic fluctuations within a preset time window, node pairs with synchronous access trends can be initially screened at the macro level. Based on this, when the correlation of traffic fluctuations exceeds a first preset threshold, the intersection ratio of the device identifier sets is further calculated. Through micro-level user overlap verification, the risk of misjudgment caused by traffic synchronization fluctuations due to accidental factors is reduced, thereby improving the accuracy of cross-domain traffic redirection relationship determination. Based on the determined cross-domain traffic redirection relationship, a cross-domain derived association edge is established. When a resource storage node is confirmed as a violation node, it can be directly traced back along this association edge, reducing the computational power consumption of blindly searching through massive numbers of nodes and improving the efficiency of tracing the source of illegal propagation.

[0014] In conjunction with some implementation methods of the first aspect, in some implementation methods, for any information publishing node and any resource storage node, the correlation of traffic fluctuations in the timestamp sequence within a preset time window is calculated, specifically including:

[0015] The timestamp sequences of the information publishing nodes and the resource storage nodes are converted into a first discrete time sequence and a second discrete time sequence with a preset time granularity, respectively.

[0016] For the first discrete time series and the second discrete time series, calculate the cross-correlation function sequence at different time offsets;

[0017] The target time offset corresponding to the peak value in the cross-correlation function sequence is extracted. The target time offset is used to characterize the system clock deviation between the first platform and the second platform.

[0018] Phase alignment compensation is performed on the second discrete time series based on the target time offset to obtain the aligned second discrete time series.

[0019] Calculate the Pearson correlation coefficient between the first discrete time series and the aligned second discrete time series, and use it as the correlation of traffic fluctuations within a preset time window for the timestamp series.

[0020] By adopting the above technical solution, after converting the timestamp sequences of the two platforms into discrete time sequences, and calculating the cross-correlation function sequences under different time offsets and extracting the target time offset corresponding to the peak, the objective system clock deviation between the first and second platforms can be quantified. Based on this target time offset, phase alignment compensation is performed on the second discrete time sequence, reducing errors caused by time asynchrony in cross-platform log recordings. The Pearson correlation coefficient is calculated using the aligned second and first discrete time sequences, ensuring that the final traffic fluctuation correlation more accurately reflects the synchronicity of traffic changes between the two nodes under the same absolute time base. This reduces the interference of cross-platform system clock deviation on traffic flow relationship analysis and improves the accuracy of traffic fluctuation correlation calculation.

[0021] In conjunction with some implementation methods of the first aspect, in some implementation methods, for any information publishing node and any resource storage node, the correlation of traffic fluctuations in the timestamp sequence within a preset time window is calculated, specifically including:

[0022] Map the timestamp sequence in the access behavior log to a preset time coordinate system, and count the cumulative access frequency at each time node to generate the first traffic accumulation sequence;

[0023] The timestamp sequence in the download behavior log is mapped to a preset time coordinate system, and the cumulative download frequency at each time node is counted to generate a second traffic accumulation sequence;

[0024] The first and second cumulative flow sequences are normalized respectively to obtain the first relative trend sequence and the second relative trend sequence;

[0025] Calculate the sequence distance between the first relative trend sequence and the second relative trend sequence, and determine the correlation of traffic fluctuations in the timestamp sequence within a preset time window based on the sequence distance.

[0026] By employing the above technical solution, timestamp sequences are mapped to a preset time coordinate system, and cumulative frequencies are statistically analyzed to generate a traffic accumulation sequence. This accumulation process smooths out instantaneous traffic spikes and random noise at discrete time points. Normalization is applied to the first and second traffic accumulation sequences to obtain relative trend sequences, reducing scale differences between information publishing nodes and resource storage nodes caused by varying absolute traffic volumes. This allows the sequence features to focus on the relative trend of traffic growth. Calculating the sequence distance between the two relative trend sequences to determine traffic fluctuation correlation provides a more stable measure of the similarity of traffic evolution between two nodes within the overall time window. This reduces the negative impact of instantaneous traffic anomalies and differences in traffic base between platforms on correlation calculations, improving the robustness of traffic fluctuation correlation assessment.

[0027] In some embodiments, in conjunction with the first aspect, after calculating the intersection ratio of the visitor device identifier set and the downloader device identifier set, the method further includes:

[0028] For each target device identifier in the intersection, obtain the first access timestamp in the access behavior log and the second access timestamp in the download behavior log;

[0029] Calculate the time difference between the second access timestamp and the first access timestamp;

[0030] Select target device identifiers whose time difference is within the preset conversion delay interval as valid conversion devices;

[0031] Calculate the proportion of effective conversion devices in the intersection ratio to obtain the conversion confidence level;

[0032] If the intersection ratio is greater than the second preset threshold and the conversion confidence is greater than the third preset threshold, it is determined that there is a cross-domain traffic redirection relationship between the information publishing node and the resource storage node.

[0033] By employing the above technical solution, after calculating the intersection of device identifiers, the first and second access timestamps of the target device identifiers in the intersection are obtained on both platforms, and the time difference between the two timestamps is calculated. This reflects the actual jump time of the user between the two nodes. By selecting target device identifiers whose time difference falls within a preset conversion delay interval as valid conversion devices, overlapping users with excessively long access intervals or those not conforming to normal cross-domain jump logic are filtered out. Further calculation of the proportion of valid conversion devices in the intersection yields the conversion confidence score. A cross-domain referral relationship is only determined when the conversion confidence score exceeds a third preset threshold. This introduces causal verification in the time dimension, reducing the probability of misjudgment caused by users independently and randomly accessing two platforms, and improving the accuracy of cross-domain referral relationship determination.

[0034] In conjunction with some implementation methods of the first aspect, in some implementation methods, a preset conversion delay interval is determined, specifically including:

[0035] Extract the content attribute features of the information publishing node. The content attribute features should include at least the media type and the length of the content.

[0036] Based on media type and content length, determine the average dwell time required for users to browse information publishing nodes;

[0037] The average dwell time is added to the preset cross-domain jump network latency to determine the upper limit of the preset conversion latency range;

[0038] The preset cross-domain jump network latency is used as the lower limit of the preset conversion latency range.

[0039] By employing the aforementioned technical solution, content attribute characteristics such as media type and content length of information publishing nodes are extracted, and the average dwell time required for users to browse that node is determined accordingly. Furthermore, the upper and lower limits of the preset conversion latency range are dynamically set in conjunction with cross-domain redirection network latency, making the conversion latency range setting more closely match the actual cross-domain access behavior rhythm of users. Because the set latency range highly matches the actual time consumption of the conversion process, the target devices from the current information publishing node to the resource storage node can be more accurately identified, thereby improving the accuracy of effective conversion device selection and reducing the misjudgment rate caused by setting the time window too large or too small.

[0040] In conjunction with some implementations of the first aspect, in some implementations, after selecting target device identifiers whose time differences fall within a preset conversion delay interval as valid conversion devices, the method further includes:

[0041] For each target device identifier in the intersection, calculate the reverse time difference between the first access timestamp and the second access timestamp. The reverse time difference is the first access timestamp minus the second access timestamp.

[0042] Select target device identifiers whose reverse time difference is within the preset conversion delay interval and use them as reverse comparison devices;

[0043] The difference between the number of effective conversion devices and the number of reverse control devices is calculated, and the ratio of the difference to the sum of the two is used as the causal asymmetry index.

[0044] If the intersection ratio is greater than the second preset threshold, the conversion confidence is greater than the third preset threshold, and the causal asymmetry index is greater than the preset asymmetry threshold, then a cross-domain traffic redirection relationship is determined to exist between the information publishing node and the resource storage node.

[0045] By employing the aforementioned technical solution, the reverse time difference between the first and second access timestamps is calculated to screen out reverse control devices that meet the conversion delay interval. Furthermore, a causal asymmetry index is calculated to represent the percentage difference between the number of effective conversion devices and the number of reverse control devices. Introducing reverse access behavior as a benchmark effectively quantifies the directional characteristics of traffic transfer between two nodes. Adding a threshold judgment for the causal asymmetry index when determining cross-domain traffic redirection relationships filters out false associations caused by random user browsing, natural traffic fluctuations, or occasional bidirectional access, ensuring that the identified traffic redirection behavior has significant unidirectional causal driving characteristics. This improves the reliability of cross-domain traffic redirection relationship determination and reduces the probability of misjudging accidental co-occurrence behaviors as traffic redirection relationships.

[0046] In conjunction with some implementations of the first aspect, in some implementations, the difference between the number of effective conversion devices and the number of reverse control devices is calculated, specifically including:

[0047] The center time value of the preset conversion delay interval is taken as the optimal conversion delay;

[0048] For each effective conversion device, the first time deviation between the corresponding time difference and the optimal conversion delay is calculated, and the first confidence weight is determined based on the first time deviation. The first time deviation and the first confidence weight are negatively correlated.

[0049] For each reverse control device, calculate the second time deviation between the corresponding reverse time difference and the optimal conversion delay, and determine the second confidence weight based on the second time deviation;

[0050] The weighted number of effective conversion devices and the weighted number of reverse control devices are obtained by summing all first confidence weights and all second confidence weights respectively.

[0051] Calculate the difference between the weighted number of effective conversion devices and the weighted number of reverse control devices.

[0052] By employing the aforementioned technical solution, the optimal conversion delay is determined by using the center time value of a preset conversion delay interval. The time deviation between the actual time difference of the effective conversion device and the reverse control device and the optimal conversion delay is calculated, and a negatively correlated confidence weight is assigned accordingly. Finally, the difference is calculated using a weighted average. This mechanism overcomes the limitation of traditional methods that treat all samples within the interval with equal weight, fully reflecting the objective law that access behavior closer to typical conversion time is more representative of traffic generation. By assigning differentiated weights to devices with different time deviations, the interference of occasional access noise at the edge of the delay interval on the overall evaluation results can be weakened. This makes the final calculated difference more realistically reflect the scale characteristics of the core traffic generation group, thereby improving the precision of the causal asymmetric index calculation and further enhancing the accuracy of cross-domain traffic generation relationship evaluation.

[0053] In a second aspect, embodiments of this application provide an Internet information processing system, which includes: one or more processors and a memory; the memory is coupled to one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors invoke the computer instructions to cause the system to perform the method described in the first aspect and any possible implementation thereof.

[0054] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a system, cause the system to perform the method described in the first aspect and any possible implementation thereof.

[0055] Fourthly, embodiments of this application provide a computer program product that, when run on a system, causes the system to execute the method described in any possible implementation of the first aspect.

[0056] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0057] 1. This application provides an internet information processing method. By acquiring the behavior logs of information publishing nodes on a first platform and resource storage nodes on a second platform, extracting timestamp sequences and device identifier sets, and calculating the correlation of traffic fluctuations within a preset time window, it can initially screen out node pairs with synchronous access trends at a macro level. Based on this, when the correlation of traffic fluctuations exceeds a first preset threshold, the intersection ratio of the device identifier sets is further calculated. Through micro-level user overlap verification, the risk of misjudgment caused by synchronous traffic fluctuations due to accidental factors is reduced, thereby improving the accuracy of cross-domain traffic redirection relationship determination. Based on the determined cross-domain traffic redirection relationship, a cross-domain derived association edge is established. When a resource storage node is confirmed as a violation node, it can directly trace back along this association edge, reducing the computational power consumption of blindly searching through massive numbers of nodes and improving the efficiency of tracing the source of illegal propagation.

[0058] 2. This application provides an internet information processing method. After calculating the intersection of device identifiers, it obtains the first and second access timestamps of the target device identifiers on two platforms, and calculates the time difference between them, which reflects the actual jump time of the user between the two nodes. By filtering out target device identifiers whose time difference is within a preset conversion delay interval as valid conversion devices, overlapping users with excessively long access intervals and inconsistent cross-domain jump logic are filtered out. The proportion of valid conversion devices in the intersection is further calculated to obtain the conversion confidence score. A cross-domain traffic relationship is only determined when the conversion confidence score is greater than a third preset threshold. This introduces causal verification in the time dimension, reduces the probability of misjudgment caused by users independently and randomly accessing two platforms, and improves the accuracy of cross-domain traffic relationship determination.

[0059] 3. This application provides an internet information processing method that, by calculating the reverse time difference between a first access timestamp and a second access timestamp, filters out reverse control devices that meet the conversion delay interval, and further calculates a causal asymmetry index representing the percentage difference between the number of effective conversion devices and the number of reverse control devices. Introducing reverse access behavior as a benchmark effectively quantifies the directional characteristics of traffic transfer between two nodes. Adding a threshold judgment for the causal asymmetry index when determining cross-domain traffic redirection relationships can filter out false associations caused by random user browsing, natural traffic fluctuations, or bidirectional sporadic access, ensuring that the identified traffic redirection behavior has significant unidirectional causal driving characteristics. This improves the reliability of cross-domain traffic redirection relationship determination and reduces the probability of misjudging accidental co-occurrence behaviors as traffic redirection relationships. Attached Figure Description

[0060] Figure 1 This is a flowchart illustrating an Internet information processing method in an embodiment of this application.

[0061] Figure 2 This is another flowchart illustrating an Internet information processing method in an embodiment of this application.

[0062] Figure 3 This is another flowchart illustrating an Internet information processing method in the embodiments of this application.

[0063] Figure 4 This is a schematic diagram of the physical device structure of an Internet information processing system provided in an embodiment of this application. Detailed Implementation

[0064] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0065] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0066] The following example is used in conjunction with Figure 1 The following describes an Internet information processing method in an embodiment of this application:

[0067] Please see Figure 1 This is a flowchart illustrating an Internet information processing method in an embodiment of this application.

[0068] S101. Obtain access behavior logs of multiple information publishing nodes in the first platform and download behavior logs of multiple resource storage nodes in the second platform.

[0069] The first platform refers to a network system within the internet environment that provides information publishing, content display, and user interaction services, such as social media networks, content sharing communities, short video applications, or comprehensive forums. An information publishing node is an independent data unit within the first platform that carries specific content, such as a text and image post, a short video, an article, or a dynamically updated webpage. Access behavior logs are the underlying data records of interactions between network users and information publishing nodes within the first platform, covering the occurrence of actions such as browsing, clicking, and dwelling. The second platform refers to a network system within the internet environment that provides file hosting, data storage, and resource distribution services, such as cloud storage services, application distribution stores, and file-sharing sites. A resource storage node is an independent storage unit within the second platform used to locate and retrieve specific data files, such as a downloadable installation package, a compressed file, or a multimedia resource link. Download behavior logs are the underlying data records of network users initiating data transfer requests to resource storage nodes and retrieving data within the second platform. The system connects to the data centers of these two distinct network platforms, obtains all interaction records of the target node within a specific time period through the underlying data interface, and uses this massive amount of raw log data as the basic data source for subsequent cross-platform correlation analysis, thereby constructing a raw data set that reflects the node's active status.

[0070] The system can periodically retrieve log data by calling the application programming interfaces (APIs) provided by the first and second platforms. The system sends a Hypertext Transfer Protocol (HTTP) request carrying authentication credentials to the data interfaces of both platforms, specifying the time range of logs to be retrieved and the corresponding node identifiers. After successful verification by the platform servers, the access and download logs are returned to the system in Extensible Markup Language (Extensible Markup Language) or Lightweight Data Interchange (LDLI) format. Upon receiving the data, the system parses it and stores it in its local distributed file system for subsequent processing.

[0071] The system can also achieve real-time data acquisition by deploying log collection agents on the servers of the first and second platforms. These agents run as daemons on various business servers, monitoring the operating system's log file directory in real time or directly mounting them to the log output stream of the business system. Once a new access or download activity occurs, the agent immediately captures the log entry and asynchronously pushes the log data to the system's data receiver via a high-throughput distributed message queue system. The system's data receiver continuously consumes the log data in the message queue, completing real-time log aggregation and unified storage.

[0072] S102. Extract the timestamp sequence and the corresponding set of visitor device identifiers from the access behavior log; extract the timestamp sequence and the corresponding set of downloader device identifiers from the download behavior log;

[0073] A timestamp sequence is a set of values ​​arranged chronologically to record the timestamps of independent interactions, typically represented in Coordinated Universal Time (UTC) or a standard time format within a specific time zone. A visitor device identifier set is an unordered combination of unique identification codes for terminal devices interacting with the information publishing node on the first platform. These codes can be media access control addresses, International Mobile Equipment Identity (IMEIs), browser fingerprints, or anonymous device identifiers assigned by the platform. A downloader device identifier set is an unordered combination of unique identification codes for terminal devices initiating download requests to the resource storage node on the second platform. The system performs deep analysis and cleaning on the massive amounts of raw access and download behavior logs. The system scans the raw log files line by line, locating preset field positions and removing redundant information unrelated to time and device identity, such as network protocol headers and request status codes. Subsequently, the system converts the extracted time information into a unified standard timestamp format and performs deduplication and standardization on the extracted device identification information. Finally, it constructs a timestamp sequence consisting purely of time nodes and a set of device identifiers consisting of unique device codes for each node, thus preparing structured data for subsequent macro traffic analysis and micro user comparison.

[0074] The system utilizes regular expression technology to perform field matching and extraction on unstructured or semi-structured log text. The system predefines regular expression rules for access logs from the first platform and download logs from the second platform. These rules precisely describe the character patterns of the timestamp and device identifier fields in the log strings. The system reads the log file line by line, inputting each line of text into the regular expression engine for pattern matching. Upon successful matching, the engine extracts the corresponding time string and device identifier string. The system converts the time string into a standard integer timestamp and stores the device identifier string in a hash set for automatic deduplication, ultimately outputting a timestamp sequence and a device identifier set.

[0075] The system can also extract data by building a log information extraction model based on named entity recognition technology in natural language processing. The system collects a large amount of log sample data labeled with time entities and device identifiers, and trains a sequence labeling model using a deep learning framework. This model can understand the contextual semantic features of log text and automatically identify character segments with time and device identifier attributes. The system inputs the raw logs into the trained named entity recognition model, and the model outputs the position and category of each entity. Based on the model's output, the system extracts the timestamps and device identifiers, and assembles them into a timestamp sequence and a corresponding set of device identifiers, respectively.

[0076] S103. For any information publishing node and any resource storage node, calculate the correlation of traffic fluctuations in the timestamp sequence within a preset time window;

[0077] The system calculates the correlation of traffic fluctuations within a preset time window for any information publishing node and any resource storage node, based on their timestamp sequences. The preset time window is a defined time span with a clear start and end point, used to limit the observation range of traffic changes, such as a specific 24-hour period, a week, or a calendar month. Traffic fluctuation correlation is a quantitative indicator of the synchronicity of the frequency of interaction between two independent nodes within the same time span. The system pairs any information publishing node with any resource storage node, placing them under the same time observation scale. The system analyzes the timestamp sequences of these two nodes within the preset time window to explore whether the download popularity of the resource storage node on the second platform exhibits a similar fluctuation trajectory when the access popularity of the information publishing node on the first platform increases or decreases. Through specific mathematical operations, the system transforms this morphological similarity in time sequences into a concrete numerical value to measure the closeness of the correlation between the two nodes in terms of macroscopic traffic trends.

[0078] This step can be achieved in at least two ways:

[0079] The system can convert the timestamp sequences of information publishing nodes and resource storage nodes into a first discrete time sequence and a second discrete time sequence with a preset time granularity, respectively. For the first discrete time sequence and the second discrete time sequence, it calculates the cross-correlation function sequence under different time offsets. It extracts the target time offset corresponding to the peak value in the cross-correlation function sequence, which is used to characterize the system clock deviation between the first platform and the second platform. Based on the target time offset, it performs phase alignment compensation on the second discrete time sequence to obtain the aligned second discrete time sequence. It calculates the Pearson correlation coefficient between the first discrete time sequence and the aligned second discrete time sequence as the correlation of traffic fluctuations of the timestamp sequence within a preset time window.

[0080] The system can also map the timestamp sequence in the access behavior log to a preset time coordinate system, and count the cumulative access frequency at each time node to generate a first traffic accumulation sequence; map the timestamp sequence in the download behavior log to a preset time coordinate system, and count the cumulative download frequency at each time node to generate a second traffic accumulation sequence; normalize the first traffic accumulation sequence and the second traffic accumulation sequence respectively to obtain a first relative trend sequence and a second relative trend sequence; calculate the sequence distance between the first relative trend sequence and the second relative trend sequence, and determine the correlation of traffic fluctuations of the timestamp sequence within a preset time window based on the sequence distance.

[0081] S104. If the correlation of traffic fluctuation is determined to be greater than the first preset threshold, calculate the intersection ratio of the visitor device identifier set and the downloader device identifier set.

[0082] The first preset threshold is a numerical boundary used to measure whether the correlation of traffic fluctuations has reached a significant level of synchronization. This threshold is derived from baseline data obtained by statistical analysis of the correlation of traffic fluctuations of historically normal, unrelated node pairs. The intersection ratio refers to the ratio of the number of device identifiers simultaneously present in both the visitor device identifier set and the downloader device identifier set to the total number of identifiers in either set or the union of the two sets. After completing the macro-level traffic fluctuation correlation calculation, the system introduces a conditional judgment mechanism. The system compares the calculated traffic fluctuation correlation value with the first preset threshold. When the correlation value is greater than this threshold, it indicates that the two nodes exhibit a high degree of synchronization in traffic trends, warranting further in-depth analysis. At this point, the system delves into the micro-level user dimension, extracting the previously prepared visitor device identifier set and downloader device identifier set. The system cross-compares these two sets to identify common devices that both accessed the information publishing node and downloaded files from the resource storage node, and calculates the proportion of these common devices in the overall device count, thereby quantifying the degree of overlap between the two nodes in the actual audience.

[0083] The system can use a hash set intersection algorithm to calculate the intersection ratio. First, the system loads all elements from the visitor device identifier set into memory, constructing a hash table with the device identifier as the key. Then, the system iterates through each element in the downloader device identifier set, performing a lookup operation in the hash table. If a match is found, it means the device identifier exists in both sets, and the system increments the intersection counter. After the iteration is complete, the system obtains the total number of intersection elements. Next, the system divides the total number of intersection elements by the union of the total number of elements in the visitor device identifier set and the downloader device identifier set to calculate the Jaccard similarity coefficient, which is then output as the intersection ratio.

[0084] The system can also utilize Bloom filter technology to estimate and calculate the intersection ratio. The system initializes a Bloom filter with an appropriate size and number of hash functions, mapping all elements from the visitor device identifier set to this filter. Then, the system iterates through the downloader device identifier set, testing each element against the Bloom filter to see if it exists in the visitor set. The system counts the number of elements that pass the test as the approximate intersection size. Finally, the system divides this approximate intersection size by the cardinality of the visitor device identifier set to obtain a one-way overlap ratio, which is used as the intersection ratio for subsequent judgments.

[0085] S105. If the intersection ratio is greater than the second preset threshold, it is determined that there is a cross-domain traffic redirection relationship between the information publishing node and the resource storage node.

[0086] The second preset threshold is a numerical limit used to determine whether the overlap of devices reaches the cross-domain traffic redirection standard. This threshold is derived from an empirical lower limit obtained by statistical analysis of the intersection ratio of node pairs with historically confirmed traffic redirection behavior. The second preset threshold and the first preset threshold together constitute a dual verification system. The first preset threshold is responsible for the coarse screening of macro trends, while the second preset threshold is responsible for the fine core of micro-level audiences. Cross-domain traffic redirection relationship refers to the behavioral connection where an information publishing node on the first platform, through content guidance, link redirection, etc., prompts users browsing that node to cross platform boundaries and go to the second platform to access and download files from a specific resource storage node. The system strictly compares the calculated intersection ratio with the second preset threshold. When the intersection ratio is greater than the second preset threshold, the system determines that this high degree of user overlap is not a random probability event, but rather due to the information publishing node sending targeted traffic to the resource storage node. Based on this, the system logically confirms that there is indeed a substantial cross-domain traffic redirection relationship between these two nodes belonging to different platforms.

[0087] The system can determine relationships based on hard-coded conditional logic. In its processing flow, the system includes a conditional branch statement that receives the intersection ratio calculated in the previous step as an input variable. This input variable is compared to a second preset threshold pre-stored in a configuration file or memory constant. If the comparison is true (i.e., the intersection ratio is strictly greater than the second preset threshold), the system instantiates a relationship object. This object contains a unique identifier for the information publishing node, a unique identifier for the resource storage node, and a timestamp indicating the relationship's establishment. The system then marks the relationship object's status as having a cross-domain referral relationship and persistently stores this object in the relational database's association table.

[0088] The system can also construct a binary classification machine learning model to assist in the determination. The system collects a large amount of historical node pair intersection ratios, traffic fluctuation correlations, and manually labeled referral relationship tags to train a logistic regression or support vector machine model. This model can learn the non-linear mapping rules between various features and referral relationships. The system inputs the intersection ratio of the current node pair into the trained model, and the model outputs a probability value between zero and one. The system compares this probability value with the decision boundary set by the model. If the probability value exceeds the decision boundary, the system determines that there is a cross-domain referral relationship between the information publishing node and the resource storage node.

[0089] S106. Based on cross-domain traffic generation relationships, establish cross-domain derived association edges between information publishing nodes and resource storage nodes;

[0090] A cross-domain derived edge is a directed or undirected connection in a graph data structure that connects a vertex representing an information publishing node to a vertex representing a resource storage node. It materializes business logic relationships across different platforms into structural elements within the topology network. After confirming the existence of a cross-domain flow relationship between the information publishing node and the resource storage node, the system begins constructing the network topology. The system maps isolated nodes in the first and second platforms to vertices in a unified graph space. Next, the system generates a connection line between these two vertices—the cross-domain derived edge. This edge not only records the start and end points of the connection but can also include relevant attribute information, such as the strength of the flow and the time window for establishing the relationship. By establishing this edge, the system breaks down data silos between platforms, weaving nodes originally scattered across different systems into an interconnected cross-domain relationship network, laying the structural foundation for subsequent global graph analysis and path tracing.

[0091] The system can establish cross-domain derived edges by creating entities and relationships in the graph database. The system calls the graph database's query language interface, first checking if the vertices representing the information publishing node and resource storage node already exist in the graph database. If not, it creates the corresponding vertex nodes and assigns them the corresponding platform and node identifier attributes. Then, the system executes a graph query statement to create a relationship, specifying the information publishing node vertex as the starting point and the resource storage node vertex as the ending point, creating a directed edge with a specific label name. The system can also append traffic fluctuation relevance and intersection ratio as key-value pair attributes to this edge, completing the physical storage of the cross-domain derived edges in the graph database.

[0092] The system can also utilize the relational table structure in a relational database to simulate the establishment of cross-domain derived edges. The system designs a dedicated cross-domain edge mapping table in the relational database, which contains three core fields: the source node primary key, the target node primary key, and the edge attribute field. The system inserts the identifier of the information publishing node into the source node's primary key field and the identifier of the resource storage node into the target node's primary key field, thereby logically establishing a many-to-many mapping relationship between the two nodes. By performing a joint query operation using Structured Query Language on this mapping table, the system can reconstruct the cross-domain derived edge network between nodes at the application layer.

[0093] S107. In response to a resource storage node being identified as a violation node, reverse tracing is performed based on cross-domain derived association edges to mark information publishing nodes that have cross-domain derived association edges with the violation node as the source of violation propagation.

[0094] A violation node refers to a resource storage node on the second platform that stores non-compliant content that violates laws and regulations, infringes intellectual property rights, or contains malicious code, and which has been formally confirmed by the platform's management mechanism or external review mechanism. Reverse tracing refers to the process of finding the source node by starting from the target node and tracing along the associated edges within the established cross-domain relationship network, moving in the opposite direction of traffic flow. The source of illegal dissemination refers to an information publishing node on the first platform that publishes misleading content or links, directly causing users to download from the violation node. The system continuously monitors node status update events on the second platform. Once a signal is received that a resource storage node has been identified as a violation node, the system immediately initiates the source tracing mechanism. Starting from this violation node, the system searches for all cross-domain derived associated edges connected to that node in the previously established cross-domain relationship network. The system traverses these associated edges in reverse to locate all relevant information publishing nodes on the first platform. The system labels these located information publishing nodes as sources of illegal dissemination so that the first platform's management system can promptly take control measures such as content removal and account bans to cut off the dissemination chain of illegal content.

[0095] The system can utilize graph traversal algorithms to trace back and mark the source of violations. The system uses the vertex identifier of the resource storage node identified as violating the rules in the graph database as the starting seed node, and sets the traversal direction to search backwards along directed edges. The system executes a breadth-first search algorithm to query all adjacent vertices that directly point to the seed node. The system extracts the node identifiers of these adjacent vertices and determines whether their platform attribute is the first platform. For vertices that meet the criteria, the system calls the graph database update interface to add a state attribute field to the data structure of these vertices and sets its value to the source of the violation, thus completing the marking.

[0096] The system can also employ a message-driven event sourcing mechanism to implement this step. The system deploys an event bus service. When a resource storage node is identified as a violation node, the second platform publishes a violation confirmation event message containing the violation node identifier to the event bus. The system's sourcing service, acting as a subscriber, listens to this message, extracts the violation node identifier, and initiates a query request to the relational database storing cross-domain derived association edges, retrieving all records where the target node's primary key equals the violation node identifier. The system obtains the primary keys of all source nodes in the query result set and then sends a source marking instruction to the first platform through an internal interface. Upon receiving the instruction, the first platform updates the status of the corresponding information publishing node in its local database to the source of the violation propagation.

[0097] In the above embodiments, by acquiring the behavior logs of the information publishing node of the first platform and the resource storage node of the second platform, extracting the timestamp sequence and device identifier set, and calculating the correlation of traffic fluctuations within a preset time window, node pairs with synchronous access trends can be initially screened at the macro level. Based on this, when the correlation of traffic fluctuations exceeds a first preset threshold, the intersection ratio of the device identifier sets is further calculated. Through micro-level user overlap verification, the risk of misjudgment caused by synchronous traffic fluctuations due to accidental factors is reduced, thereby improving the accuracy of cross-domain traffic redirection relationship determination. Based on the determined cross-domain traffic redirection relationship, a cross-domain derived association edge is established. When a resource storage node is confirmed as a violation node, it can be directly traced back along this association edge, reducing the computational power consumption of blindly investigating among massive nodes and improving the efficiency of tracing the source of illegal propagation.

[0098] In the above embodiments, the cross-domain traffic redirection relationship between nodes was initially determined mainly by the intersection ratio of macroscopic traffic fluctuation correlation and microscopic device identifiers. However, relying solely on the intersection ratio may not completely eliminate the possibility of users independently accessing two platforms over a long period of time, thus leading to false "pseudo-overlap" judgments. To further improve the accuracy of traffic redirection relationship determination and eliminate interference from abnormal cross-domain redirection logic, this application introduces another Internet information processing method after calculating the intersection ratio of the device identifier sets. The following section combines... Figure 2 Another Internet information processing method in the embodiments of this application is described below:

[0099] Please see Figure 2 This is another flowchart illustrating an Internet information processing method in an embodiment of this application.

[0100] S201. For each target device identifier in the intersection, obtain the first access timestamp in the access behavior log and the second access timestamp in the download behavior log.

[0101] The target device identifier refers to the unique identification code of a terminal device that exists simultaneously in both the visitor device identifier set and the downloader device identifier set. The first access timestamp refers to the specific moment when the target device identifier interacts with the information publishing node on the first platform. The second access timestamp refers to the specific moment when the same target device identifier initiates a data transmission request to the resource storage node on the second platform. After determining the intersection of device identifiers, the system needs to further obtain the specific time points of these overlapping devices' actions on both platforms. The system traverses each target device identifier in the intersection, backtracks the access behavior logs of the first platform and the download behavior logs of the second platform, accurately locates the log entry corresponding to that device identifier, and extracts the precise time data of the recorded behavior, thus providing basic data support for subsequent time-dimensional analysis.

[0102] The system can obtain timestamps based on relational database indexing techniques. The system establishes query structures indexed by device identifiers for both the access behavior log table and the download behavior log table in the relational database. For each target device identifier in the intersection, the system constructs a structured query language statement, uses the index to quickly locate the corresponding log record, and extracts the timestamp field value, loading it into memory as the first access timestamp and the second access timestamp, respectively.

[0103] The system can also utilize key-value pair mapping operations within a distributed memory computing framework to obtain timestamps. The system loads the original access and download logs into distributed memory and converts them into key-value pair elastic distributed datasets with device identifiers as keys and timestamps as values. Next, the system also converts the set containing the target device identifier into an elastic distributed dataset. By executing distributed join operations, the target device identifier is matched against the two log datasets, thereby obtaining the first and second access timestamps corresponding to each target device identifier in parallel.

[0104] S202. Calculate the time difference between the second access timestamp and the first access timestamp;

[0105] The time difference refers to the absolute time interval between the moment a target device identifier accesses content on the first platform and the moment a download occurs on the second platform. It is used to quantify the time cost incurred by the device in completing the cross-platform jump. After obtaining the first and second access timestamps for each target device identifier in the intersection, the system performs mathematical operations on these two timestamps. The system subtracts the time value represented by the first access timestamp from the time value represented by the second access timestamp to obtain the time span between the two. This calculation process aims to reveal how long it took for a user to trigger a download operation on the resource storage node after browsing the content on the information publishing node, thus providing a quantitative basis in the time dimension for assessing the causal relationship of this cross-domain behavior.

[0106] The system can directly calculate the time difference using the built-in timestamp subtraction logic of the underlying programming language. After obtaining the first and second access timestamps, the system ensures that both are in the format of seconds or milliseconds since a specific epoch of Coordinated Universal Time. Then, the system executes basic subtraction instructions in the arithmetic logic unit of the central processing unit, subtracting the integer value of the first access timestamp from the integer value of the second access timestamp; the difference is the time difference in seconds or milliseconds. After reading the raw data of the first and second access timestamps, the system first verifies and cleans the data format, removing abnormal records containing illegal characters or null values. Next, the system uniformly converts the valid raw time data into 64-bit long integers to prevent data overflow when processing time points far removed from a specific epoch of Coordinated Universal Time. Since the precision of log records may differ across platforms, the system reads preset precision configuration parameters to determine whether the units of the two timestamps are consistent. If the first access timestamp is in seconds and the second access timestamp is in milliseconds, the system multiplies the second-level value by one thousand by executing a multiplication instruction, forcing them to align to millisecond precision. After unifying the dimensions, the system loads the two long integer values ​​into the CPU's registers and calls the arithmetic logic unit to perform a subtraction operation, subtracting the first access timestamp from the second access timestamp. To ensure the physical meaning of the time difference is valid, the system also performs a sign check on the result. If the result is negative, it indicates that the access order violates causal logic, and the system marks the record as invalid data and discards it. If the result is positive, the system uses the long integer difference as the final time difference and binds it to the corresponding target device identifier, constructing a key-value pair structure and storing it in a hash table in memory for direct use in subsequent filtering steps.

[0107] The system can also call date and time processing library functions encapsulated in high-level programming languages ​​to calculate time differences. The system instantiates the obtained timestamp string or value into a standard date and time object. Then, the system calls the time interval calculation method provided by the date and time object. This method automatically handles complex time logic such as possible time zone differences, leap seconds, and different numbers of days in different months, ultimately returning a standardized and high-precision time interval object. The system extracts the specific value from this object as the time difference. The system pre-loads a date and time processing library with high-precision time processing capabilities into memory. For the obtained first and second access timestamps in string format, the system calls the format parser in the library. Based on a preset date and time matching template, it parses the discrete string character by character and instantiates it into two independent standard date and time objects in memory. During instantiation, the system extracts the time zone identifier attached to the timestamp string. If the timestamps of the two platforms are found to be in different time zones, the system automatically calls the time zone conversion function to standardize and convert both date and time objects to the zero time zone based on Coordinated Universal Time (UTC), thereby eliminating time offset errors caused by differences in server geographical location. Subsequently, the system invokes the built-in time interval calculation method of the date and time object, passing in two standardized objects as input parameters. This calculation method automatically handles complex calendar logic at the underlying level, including changes in the number of days across months, years, and leap years, as well as leap seconds, ultimately generating a time interval object in memory that encapsulates precise time span information. The system then calls the attribute extraction interface of this time interval object to uniformly convert the internally stored span information into values ​​in seconds or milliseconds, using this as the final time difference value, and serializes and saves it to the distributed cache system.

[0108] S203. Select target device identifiers whose time difference is within the preset conversion delay interval as valid conversion devices;

[0109] The system filters out target device identifiers whose time difference falls within a preset conversion delay interval as valid conversion devices. The determination of the preset conversion delay interval specifically includes: extracting the content attribute features of the information publishing node, which at least include media type and content length; determining the average dwell time required for users to browse the information publishing node based on media type and content length; adding the average dwell time to the preset cross-domain jump network delay to determine the upper limit of the preset conversion delay interval; and using the preset cross-domain jump network delay as the lower limit of the preset conversion delay interval.

[0110] The preset conversion latency range refers to the time span within which a user's cross-domain redirection behavior conforms to normal logic, including a lower limit and an upper limit. An effective conversion device is a target device whose cross-domain redirection time difference strictly falls within the preset conversion latency range. Content attribute characteristics refer to data dimensions describing the inherent attributes of the content carried by the information publishing node, such as media type and content length. Media type refers to the content's presentation format, such as plain text, mixed text and images, short video, or long audio. Content length refers to the content's volume, such as the number of words in text, the number of images, or the playback duration of audio or video. Average dwell time refers to the estimated time required for an average user to fully consume an information publishing node with specific content attribute characteristics. The preset cross-domain redirection network latency refers to the average physical time required for a user's device to switch from the first platform to the second platform and establish a network connection. The system first parses the content of the information publishing node, extracting its media type and specific length. Based on these characteristics, the system estimates the approximate time an average user would need to browse the content. Next, the system uses the basic network redirection time as the lower limit of the reasonable redirection time, and adds the time required for the user to browse the content to the network redirection time as the upper limit of the reasonable redirection time, thus constructing a dynamic time interval. Finally, the system compares the previously calculated time difference values ​​of each target device identifier with this interval to filter out the target device identifiers that meet the criteria.

[0111] The system can determine a preset conversion latency range and filter effective conversion devices based on a pre-configured static rule mapping table. The system pre-configures a mapping table that defines the average reading or viewing speed per unit content length for different media types; for example, plain text is defined as a specific number of words per minute, and short videos as the actual playback duration. After extracting the media type and content length of the information publishing node, the system calculates the average dwell time by looking up the table. The system uses a fixed preset cross-domain redirection network latency as the lower limit and adds the average dwell time to this network latency as the upper limit to construct the preset conversion latency range. Subsequently, the system iterates through the time difference values ​​of target device identifiers and filters out device identifiers within this range using conditional statements.

[0112] The system can also utilize deep neural network models to determine and filter preset conversion latency intervals. The system constructs a multilayer perceptron model, trained using a large amount of data from historical logs on actual user dwell time, corresponding media types, and content length. This model learns the complex nonlinear mapping relationship between different content features and user time consumption. The system performs one-hot encoding on the media type of the current information publishing node and normalizes the content length, then inputs both into the trained multilayer perceptron model. The model outputs the predicted average dwell time. The system combines dynamically acquired current network average latency data to calculate the upper and lower limits of the preset conversion latency interval. Finally, the system uses vectorized computation techniques to create an array of time differences for all target device identifiers, compares it in batches with the interval boundaries, and quickly filters out effective conversion devices.

[0113] S204. Calculate the proportion of effective conversion devices in the intersection ratio to obtain the conversion confidence level;

[0114] Conversion confidence refers to the proportion of devices with valid conversions out of the total number of target device identifiers in all cross-domain overlap scenarios. It measures the reliability of cross-domain traffic redirection relationships in terms of temporal causal logic. After filtering out valid conversion devices that conform to normal cross-domain jump time logic, the system needs to further quantify the prevalence of such valid conversions among all overlapping users. The system counts the specific number of devices determined to have valid conversions and divides it by the total number of target device identifiers in the previously determined intersection. This calculation process converts the absolute number of devices into a relative percentage value, reflecting the proportion of users among all seemingly overlapping users who truly conform to the causal time sequence and whose visits are not accidental or independent. This provides a key confidence indicator for the final determination of traffic redirection relationships.

[0115] The system can calculate conversion confidence using basic arithmetic division in a single-machine memory environment. The system maintains two integer counter variables in memory to record the total number of target device identifiers and the number of valid conversion devices selected, respectively. After completing the selection step, the system directly reads the current values ​​of these two counters. The system forcibly converts the integer variable representing the number of valid conversion devices to a floating-point variable, then divides it by the floating-point variable representing the total number of target device identifiers, performing a floating-point division instruction to obtain a decimal between zero and one, which is stored in memory as the conversion confidence.

[0116] The system can also utilize aggregation operators in the streaming computing engine to calculate conversion confidence. The system inputs the target device identifier and the data stream of the valid conversion device into the streaming computing platform. The system configures a time window within which aggregation operators are used to count the two types of data streams in real time. When the window triggers calculation, the system extracts the two count values ​​output by the aggregation operator, performs a division operation using a custom calculation function, and outputs the calculated conversion confidence result to a downstream message queue or real-time database for use in subsequent decision-making steps.

[0117] S205. If the intersection ratio is greater than the second preset threshold and the conversion confidence is greater than the third preset threshold, it is determined that there is a cross-domain traffic redirection relationship between the information publishing node and the resource storage node.

[0118] The third preset threshold is a numerical limit used to measure whether the conversion confidence level meets the standard for confirming a cross-domain traffic redirection relationship. This threshold is derived from statistical analysis of the conversion confidence level distribution in historical real traffic redirection scenarios and represents the minimum effective conversion ratio required to exclude accidental overlap factors. The third preset threshold and the second preset threshold together constitute a more rigorous judgment condition. The second preset threshold focuses on assessing the absolute scale ratio of overlapping users, while the third preset threshold focuses on assessing the purity of temporal causal logic among these overlapping users. After obtaining the conversion confidence level, the system performs a final logical judgment. The system extracts the previously calculated intersection ratio and the newly calculated conversion confidence level, and compares them with the corresponding second and third preset thresholds, respectively. Only when both indicators simultaneously meet the condition of being greater than their respective thresholds does the system determine that this cross-domain behavior has both sufficient scale and conforms to rigorous temporal logic, and thus formally determines that there is a conclusive cross-domain traffic redirection relationship between the information publishing node and the resource storage node.

[0119] The system can determine relationships based on conditional control statements using logical AND operators. The core processing logic includes a conditional statement containing the logical AND operator. The left-hand expression checks if the intersection ratio is greater than a second preset threshold configured in memory, while the right-hand expression checks if the transformation confidence is greater than a third preset threshold configured in memory. When the system executes this statement, if both expressions return true, the system triggers the subsequent relationship establishment process, generating cross-domain referral relationship records and writing them to the relational database.

[0120] The system can also utilize the rule engine middleware to implement this judgment logic. The system configures a composite judgment rule in the rule engine's management backend, defining the intersection ratio and conversion confidence as the rule's input facts, and the second and third preset thresholds as the rule's comparison parameters. At runtime, the system encapsulates the intersection ratio and conversion confidence data of the current node pair into a fact object and injects it into the rule engine's session. The rule engine evaluates this fact object using a pattern matching algorithm. If it satisfies the configured composite rule, it triggers a preset action and outputs a judgment result indicating the existence of a cross-domain traffic redirection relationship.

[0121] In the above embodiments, after calculating the intersection of device identifiers, the first and second access timestamps of the target device identifiers in the intersection are obtained on the two platforms respectively, and the time difference between the two is calculated, which can reflect the actual jump time of the user between the two nodes. By filtering out target device identifiers whose time difference is within a preset conversion delay interval as valid conversion devices, overlapping users with excessively long access intervals and inconsistent with normal cross-domain jump logic are filtered out. The proportion of valid conversion devices in the intersection is further calculated to obtain the conversion confidence score, and a cross-domain traffic relationship is determined only when the conversion confidence score is greater than a third preset threshold. This introduces causal verification in the time dimension, reduces the probability of misjudgment caused by users independently and randomly accessing two platforms, and improves the accuracy of cross-domain traffic relationship determination.

[0122] In the above embodiments, by screening effective conversion devices and calculating conversion confidence, the causality of cross-domain access was successfully verified from a time perspective, effectively filtering out independent and random overlapping users. However, in real-world complex network environments, there may be frequent bidirectional interactions or synchronous fluctuations in natural traffic between some nodes, resulting in a lack of clear unidirectional traffic redirection characteristics even if positive conversion is established. To ensure that the identified traffic redirection behavior has significant unidirectional causal driving force, this application further introduces reverse access behavior as a control benchmark based on the screening of effective conversion devices. The following is a combination of... Figure 3 The following describes yet another Internet information processing method in the embodiments of this application:

[0123] Please see Figure 3 This is another flowchart illustrating an Internet information processing method in this application.

[0124] S301. For each target device identifier in the intersection, calculate the reverse time difference between the first access timestamp and the second access timestamp;

[0125] For each target device identifier in the intersection, the system calculates the reverse time difference between the first access timestamp and the second access timestamp. The reverse time difference is the first access timestamp minus the second access timestamp. The target device identifier refers to a string or code used to uniquely identify the hardware or software environment of each terminal in the network, such as, but not limited to, Media Access Control addresses, International Mobile Equipment Identity (IMEI), advertising identifiers, or browser cache identifiers. The first access timestamp represents the specific time point record of the target device's browsing, clicking, or other interactive behaviors at the information publishing node. The second access timestamp represents the specific time point record of the target device's subsequent conversion behaviors such as downloading or registering at the resource storage node. The reverse time difference is a quantitative representation of the reverse time span between the device's operation time at a subsequent node and its operation time at a preceding node on the timeline. For a given set of devices, the system extracts the two interaction time records for each device and performs a subtraction operation in the opposite direction of specific time elapsed. Specifically, this involves subtracting the interaction time recorded on the resource storage node from the interaction time recorded on the information publishing node to obtain an absolute value for measuring the time interval of reverse access behavior, thereby providing basic data support for subsequent identification of anomalies or bidirectional traffic.

[0126] The system can extract the time fields from access and download behavior logs, convert them into a unified timestamp format under Coordinated Universal Time (UTC), and then use the arithmetic logic unit (ALU) of the central processing unit to perform a subtraction operation between the first access timestamp and the second access timestamp for each target device identifier. The calculated reverse time difference is then stored in the corresponding field of a relational database. Alternatively, the system can employ a distributed stream processing framework to read the data streams reported by each node in real time in memory. The built-in time processing function aligns the timestamps of different time zones. Then, the subtraction logic between the first and second access timestamps is executed concurrently on the memory computing nodes. Finally, the generated reverse time difference result is output to a distributed message queue for downstream processes to use.

[0127] S302. Select target device identifiers whose reverse time difference is within the preset conversion delay interval and use them as reverse comparison devices.

[0128] The preset conversion latency range refers to a pre-defined time range that meets the requirements for a normal user to perform a cross-domain jump and complete a specific conversion action between different network nodes. This range typically consists of a minimum time limit and a maximum time limit, and can include, but is not limited to, reasonable time spans such as one to ten minutes or thirty seconds to five minutes. Reverse control devices refer to terminal devices in the intersection device set whose reverse access time intervals fall exactly within the aforementioned reasonable time range. These devices represent a group of devices undergoing reverse flow from resource storage nodes to information publishing nodes. After obtaining the reverse time difference values ​​of all target device identifiers, the system compares these differences one by one with the set reasonable time range. Through this conditional filtering mechanism, devices whose time intervals conform to the reverse jump logic are separated from the overall set and separately marked as reverse control groups. This process aims to accurately locate the reverse natural traffic or bidirectional interactive traffic existing in the network environment, thereby establishing a reliable comparison benchmark for subsequently eliminating data interference caused by occasional bidirectional access.

[0129] The system can iterate through the array storing all target device identifiers and their reverse time differences, and use conditional statements to check whether each reverse time difference is greater than or equal to the lower limit of the preset conversion delay interval and less than or equal to the upper limit of the interval. If the condition is met, the corresponding target device identifier is appended to a list specifically used to store reverse comparison devices. The system can also rely on a graph computing engine or columnar storage database to use the upper and lower limits of the preset conversion delay interval as query filtering conditions to perform batch interval range queries on data tables containing reverse time differences, directly filtering out data rows that meet the time span requirements, and exporting the device identifier fields corresponding to these data rows to construct a set of reverse comparison devices.

[0130] S303. Calculate the difference between the number of effective conversion devices and the number of reverse control devices, and use the ratio of the difference to the sum of the two as the causal asymmetry index.

[0131] The system calculates the difference between the number of effective conversion devices and the number of reverse control devices. Effective conversion devices refer to terminal devices that follow the forward jump logic and whose time intervals meet the requirements. The quantity represents the total number of elements in a specific device set. The difference is the numerical result obtained by subtracting the total number of forward devices from the total number of reverse devices. The ratio is the quotient obtained by dividing the above difference by the sum of the total number of forward and reverse devices. The causal asymmetry index is a comprehensive indicator used to quantify the degree of unidirectional traffic transfer between two network nodes. The center time value is the midpoint between the upper and lower limits of the preset conversion delay interval. The optimal conversion delay represents the standard time that theoretically best matches the user's normal jump habits. The first time deviation and the second time deviation refer to the degree of deviation between the actual time of forward and reverse devices and the standard time, respectively. The first confidence weight and the second confidence weight are reliability scores assigned based on the degree of deviation; the smaller the deviation, the higher the score. The weighted quantity is the corrected total number of devices after incorporating the reliability scores. The system first determines the theoretically optimal jump time, and then evaluates the difference between the actual time of forward and reverse devices and the optimal time. Each device is assigned a weight based on the magnitude of the difference, with larger weights for smaller differences. These weights are then summed to obtain the corrected total number of forward and reverse devices. Finally, the difference between these two corrected totals is calculated to more accurately reflect the true strength of unidirectional traffic.

[0132] This step can be implemented as follows: The center time value of the preset conversion delay interval is taken as the optimal conversion delay; for each effective conversion device, the first time deviation between the corresponding time difference and the optimal conversion delay is calculated, and a first confidence weight is determined based on the first time deviation, which is negatively correlated with the first confidence weight; for each reverse control device, the second time deviation between the corresponding reverse time difference and the optimal conversion delay is calculated, and a second confidence weight is determined based on the second time deviation; all first confidence weights and all second confidence weights are summed to obtain the weighted number of effective conversion devices and the weighted number of reverse control devices; the difference between the weighted number of effective conversion devices and the weighted number of reverse control devices is calculated.

[0133] The system can calculate the arithmetic mean of the upper and lower limits of a preset conversion delay interval as the optimal conversion delay. For each effective conversion device and reverse control device, it calculates the absolute difference between the time difference and the optimal conversion delay as the time deviation. Using a linear decay algorithm, a base maximum weight is set, and the product of the time deviation and the decay coefficient is subtracted to determine the confidence weight. Then, an accumulator is used to sum all the first and second confidence weights to obtain the weighted quantity. Finally, the difference between the two is obtained by arithmetic subtraction. Alternatively, the system can select the median of a preset conversion delay interval as the optimal conversion delay, calculate the mean square error between the time difference and the optimal conversion delay as the time deviation, and use a Gaussian distribution function or exponential decay function to map the time deviation to a confidence weight between zero and one. Then, in a distributed computing cluster, the various weights are summed in parallel through a mapping reduction mechanism to obtain a high-precision weighted quantity. Finally, a high-precision floating-point subtraction operation is performed to obtain the difference of the weighted quantities.

[0134] S304. If the intersection ratio is greater than the second preset threshold, the conversion confidence is greater than the third preset threshold, and the causal asymmetry index is greater than the preset asymmetry threshold, it is determined that there is a cross-domain traffic redirection relationship between the information publishing node and the resource storage node.

[0135] The intersection ratio refers to the percentage of devices simultaneously accessing two nodes out of a specific baseline number of devices. The second preset threshold is the minimum value used to measure whether the overlap meets the association standard, derived from statistical analysis of historical normal traffic fluctuation data. The conversion confidence level refers to the proportion of devices with effective conversions among the overlapping devices. The third preset threshold is the minimum value used to determine whether a positive conversion is statistically significant, derived from the industry standard average conversion rate indicator. The preset asymmetric threshold is the minimum value used to measure whether the one-way traffic characteristic is sufficiently significant, derived from the boundary line determined by differential analysis of the causal asymmetric index of known one-way traffic scenarios and two-way interaction scenarios. These three types of thresholds constitute a progressively progressive funnel-shaped verification relationship, with the pre-threshold used for initial screening and the post-threshold used for in-depth confirmation. After obtaining the intersection ratio, conversion confidence level, and causal asymmetric index, the system compares them sequentially with the corresponding thresholds. Only when these three core indicators simultaneously cross the set threshold will the system finally confirm that the traffic overlap or bidirectional interaction between the information publishing node and the resource storage node is not accidental, but rather that there is a definite cross-domain traffic relationship driven unidirectionally from the information publishing node to the resource storage node.

[0136] The system can construct a rule execution engine with multi-level conditional branches, taking the intersection ratio, conversion confidence, and causal asymmetry index as input parameters. Following a set logic and operation order, it sequentially judges whether each parameter is strictly greater than the second, third, and preset asymmetric thresholds loaded in the configuration file. If all judgment nodes return true, it outputs a flag indicating the establishment of the referral relationship in the system log and triggers the subsequent referral settlement process. Alternatively, the system can utilize a pre-trained machine learning classification model to implement this judgment process. This model achieves this functionality because it ingests massive amounts of labeled cross-domain node interaction data during the training phase, learning the non-linear mapping pattern between various indicators and the actual referral relationship. The system encapsulates these three indicator values ​​into feature vectors and inputs them into the classification model. The model internally calculates and outputs a predicted value representing the probability of the referral relationship's existence through an activation function. When this predicted value meets the set conditions, the system receives the positive judgment result output by the model, thus confirming the existence of the cross-domain referral relationship.

[0137] In the above embodiments, by calculating the reverse time difference between the first access timestamp and the second access timestamp, reverse control devices that meet the conversion delay interval are screened out, and the causal asymmetry index of the ratio of the difference between the number of effective conversion devices and the number of reverse control devices is further calculated. Introducing reverse access behavior as a benchmark can effectively quantify the directional characteristics of traffic transfer between two nodes. Adding a threshold judgment for the causal asymmetry index when determining cross-domain traffic redirection relationships can filter out false associations caused by random user browsing, natural traffic fluctuations, or bidirectional occasional access, ensuring that the identified traffic redirection behavior has significant unidirectional causal driving characteristics, thereby improving the reliability of cross-domain traffic redirection relationship determination and reducing the probability of misjudging accidental co-occurrence behavior as a traffic redirection relationship.

[0138] The system in the embodiments of this invention is described below from the perspective of hardware processing. Please refer to [link / reference needed]. Figure 4 This is a schematic diagram of the physical device structure of an Internet information processing system provided in an embodiment of this application.

[0139] It should be noted that, Figure 4 The structure of the system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0140] like Figure 4As shown, the system includes a Central Processing Unit (CPU) 401, which can perform various appropriate actions and processes based on a program stored in Read-Only Memory (ROM) 402 or a program loaded from storage portion 408 into Random Access Memory (RAM) 403, such as executing the methods described in the above embodiments. The RAM 403 also stores various programs and data required for system operation. The CPU 401, ROM 402, and RAM 403 are interconnected via a bus 404. An Input / Output (I / O) interface 405 is also connected to the bus 404.

[0141] The following components are connected to I / O interface 405: input section 406 including a camera, infrared sensor, etc.; output section 407 including a liquid crystal display (LCD) and speakers, etc.; storage section 408 including a hard disk, etc.; and communication section 409 including a network interface card such as a LAN (Local Area Network) card and a modem, etc. Communication section 409 performs communication processing via a network such as the Internet. Drive 410 is also connected to I / O interface 405 as needed. Removable media 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 410 as needed so that computer programs read from it can be installed into storage section 408 as needed.

[0142] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by central processing unit (CPU) 401, it performs the various functions defined in the present invention.

[0143] It should be noted that the computer-readable medium shown in the embodiments of the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. The transmitted data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0144] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0145] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the system described in the above embodiments; or it may exist independently and not assembled into the system. The storage medium carries one or more computer programs that, when executed by a processor of a system, cause the system to implement the methods provided in the above embodiments.

[0146] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0147] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0148] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0149] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. An internet information processing method, characterized in that, include: Obtain access behavior logs from multiple information publishing nodes within the first platform and download behavior logs from multiple resource storage nodes within the second platform; Extract the timestamp sequence and the corresponding set of visitor device identifiers from the access behavior log; extract the timestamp sequence and the corresponding set of downloader device identifiers from the download behavior log; For any information publishing node and any resource storage node, calculate the correlation of traffic fluctuations of the timestamp sequence within a preset time window; If the correlation of the traffic fluctuation is determined to be greater than a first preset threshold, the intersection ratio of the visitor device identifier set and the downloader device identifier set is calculated; If the intersection ratio is determined to be greater than the second preset threshold, it is determined that there is a cross-domain traffic redirection relationship between the information publishing node and the resource storage node; Based on the cross-domain traffic redirection relationship, a cross-domain derived association edge is established between the information publishing node and the resource storage node; In response to the resource storage node being identified as a violation node, reverse tracing is performed based on the cross-domain derived association edge to mark the information publishing node that has a cross-domain derived association edge with the violation node as the source of violation propagation.

2. The method according to claim 1, characterized in that, The step of calculating the correlation between traffic fluctuations of the timestamp sequence within a preset time window for any information publishing node and any resource storage node specifically includes: The timestamp sequence of the information publishing node and the timestamp sequence of the resource storage node are respectively converted into a first discrete time sequence and a second discrete time sequence with a preset time granularity; For the first discrete time series and the second discrete time series, calculate the cross-correlation function sequence at different time offsets; Extract the target time offset corresponding to the peak value in the cross-correlation function sequence. The target time offset is used to characterize the system clock deviation between the first platform and the second platform. Based on the target time offset, phase alignment compensation is performed on the second discrete time series to obtain the aligned second discrete time series. Calculate the Pearson correlation coefficient between the first discrete time series and the aligned second discrete time series, and use it as the correlation of traffic fluctuations of the timestamp series within a preset time window.

3. The method according to claim 1, characterized in that, The step of calculating the correlation between traffic fluctuations of the timestamp sequence within a preset time window for any information publishing node and any resource storage node specifically includes: The timestamp sequence in the access behavior log is mapped to a preset time coordinate system, and the cumulative access frequency at each time node is counted to generate a first traffic accumulation sequence. The timestamp sequence in the download behavior log is mapped to the preset time coordinate system, and the cumulative download frequency at each time node is counted to generate a second traffic accumulation sequence; The first flow accumulation sequence and the second flow accumulation sequence are normalized respectively to obtain the first relative trend sequence and the second relative trend sequence; Calculate the sequence distance between the first relative trend sequence and the second relative trend sequence, and determine the correlation of traffic fluctuations of the timestamp sequence within a preset time window based on the sequence distance.

4. The method according to claim 1, characterized in that, After calculating the intersection ratio of the visitor device identifier set and the downloader device identifier set, the method further includes: For each target device identifier in the intersection, obtain the first access timestamp in the access behavior log and the second access timestamp in the download behavior log; Calculate the time difference between the second access timestamp and the first access timestamp; Target device identifiers whose time difference falls within a preset conversion delay interval are selected as valid conversion devices; Calculate the proportion of the effective conversion device in the intersection ratio to obtain the conversion confidence level; If the intersection ratio is greater than the second preset threshold and the conversion confidence is greater than the third preset threshold, it is determined that there is a cross-domain traffic redirection relationship between the information publishing node and the resource storage node.

5. The method according to claim 4, characterized in that, Determining the preset conversion delay interval specifically includes: Extract the content attribute features of the information publishing node, wherein the content attribute features include at least media type and content length; Based on the media type and the content length, determine the average dwell time required for a user to browse the information publishing node; The upper limit of the preset conversion delay interval is determined by adding the average dwell time to the preset cross-domain jump network delay. The preset cross-domain jump network delay is used as the lower limit of the preset conversion delay interval.

6. The method according to claim 4, characterized in that, After selecting target device identifiers whose time difference values ​​fall within a preset conversion delay interval as valid conversion devices, the method further includes: For each target device identifier in the intersection, calculate the reverse time difference between the first access timestamp and the second access timestamp, where the reverse time difference is the first access timestamp minus the second access timestamp; Select target device identifiers whose reverse time difference values ​​are within the preset conversion delay interval, and use them as reverse comparison devices; The difference between the number of effective conversion devices and the number of reverse control devices is calculated, and the ratio of the difference to the sum of the two is used as the causal asymmetry index. If the intersection ratio is greater than the second preset threshold, the conversion confidence is greater than the third preset threshold, and the causal asymmetry index is greater than the preset asymmetry threshold, then it is determined that there is a cross-domain traffic redirection relationship between the information publishing node and the resource storage node.

7. The method according to claim 6, characterized in that, The calculation of the difference between the number of effective conversion devices and the number of reverse control devices specifically includes: The center time value of the preset conversion delay interval is taken as the optimal conversion delay; For each effective conversion device, a first time deviation between the corresponding time difference and the optimal conversion delay is calculated, and a first confidence weight is determined based on the first time deviation, wherein the first time deviation is negatively correlated with the first confidence weight. For each of the reverse control devices, a second time deviation between the corresponding reverse time difference and the optimal conversion delay is calculated, and a second confidence weight is determined based on the second time deviation. The weighted number of effective conversion devices and the weighted number of reverse control devices are obtained by summing all the first confidence weights and all the second confidence weights respectively. Calculate the difference between the weighted number of the effective conversion device and the weighted number of the reverse control device.

8. An Internet information processing system, characterized in that, The system includes: One or more processors and a memory; the memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, the one or more processors invoking the computer instructions to cause the system to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are executed on the system, the system performs the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, When the computer program product is run on the system, the system performs the method as described in any one of claims 1-7.

Images