Abnormal message identification method and device, electronic equipment, product and storage medium

Abstract

The invention provides an abnormal message identification method and device, electronic equipment, a product and a storage medium, and relates to the technical field of communication security. The method comprises the steps of obtaining a to-be-detected message sent by a target user terminal, and determining a matching result of a message keyword of the to-be-detected message and each sensitive word in a preset sensitive word set; the preset sensitive word set comprises a first-level sensitive word set and a second-level sensitive word set, and the sensitive degree of each sensitive word in the first-level sensitive word set is greater than that of each sensitive word in the second-level sensitive word set; the target user terminal is configured to receive an operation instruction of a target user; determining the same matching times based on the matching result; and determining that the target user is an abnormal message suspicion user based on a comparison result of the matching same frequency and a preset safety frequency threshold. According to the invention, the error of mistakenly recognizing the normal behavior of the user as the abnormal behavior is reduced, and the recognition accuracy of the abnormal message recognition technology can be improved.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to an abnormal message identification method, device, electronic equipment, product and storage medium. Background Art

[0002] With the rapid development of communication technology, the misleading of the public by abnormal messages may pose a major threat to the public's property safety and personal privacy. Traditional abnormal message identification technology mainly prevents the occurrence of abnormal information behavior by monitoring the content of text messages sent and received by users.

[0003] However, although traditional abnormal message recognition technology effectively reduces the occurrence of abnormal behavior, it also faces problems that cannot be ignored. Traditional abnormal message recognition technology relies on preset rules to identify sensitive content in user text messages. When users conduct legal financial transactions, the text message content may involve sensitive content such as bank cards or ID cards. At this time, traditional abnormal message recognition technology can easily misidentify the user's normal behavior as abnormal behavior. Therefore, how to improve the recognition accuracy of abnormal message recognition technology is a problem that needs to be solved urgently. Summary of the invention

[0004] The present invention provides an abnormal message recognition method, device, electronic device, product and storage medium, which are used to solve the defect of the prior art that the normal behavior of the user is easily misidentified as abnormal behavior, thereby improving the recognition accuracy of the abnormal message recognition technology.

[0005] The present invention provides an abnormal message identification method, comprising: Obtaining a message to be detected sent by a target user terminal, and determining matching results between a message keyword of the message to be detected and each sensitive word in a preset sensitive word set; the preset sensitive word set includes a first-level sensitive word set and a second-level sensitive word set, and the sensitivity of each sensitive word in the first-level sensitive word set is greater than the sensitivity of each sensitive word in the second-level sensitive word set; the target user terminal is configured to receive an operation instruction of a target user; Based on each of the matching results, determine the number of identical matches; the number of identical matches includes the first-level identical matches and the second-level identical matches; the first-level identical matches are the number of identical matches between the message keywords of the message to be detected and each sensitive word in the first-level sensitive word set; the second-level identical matches are the number of identical matches between the message keywords of the message to be detected and each sensitive word in the second-level sensitive word set; Based on the comparison result of the identical number of matches with a preset safety number threshold, the target user is determined to be a suspected user of abnormal messages; the preset safety number threshold includes a first-level safety number threshold and a second-level safety number threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the identical number of first-level matches with the first-level safety number threshold, and the second comparison result is obtained by comparing the identical number of second-level matches with the second-level safety number threshold.

[0006] According to an abnormal message identification method provided by the present invention, the method further includes: Identify the link content of the target user's message to be detected based on the link identification rule to obtain a first link identification result, and determine that the target user is a suspected user of abnormal messages based on the first link identification result; Among them, the link identification rules include abnormal domain name identification rules and abnormal location identification rules. The abnormal domain name identification rules are used to identify the abnormal domain name of the link content, and the abnormal location identification rules are used to identify the abnormal location of the website corresponding to the link content.

[0007] According to an abnormal message identification method provided by the present invention, after determining that the target user is a suspected abnormal message user based on the comparison result of the matching identical number of times and the preset safety number threshold, the method further includes: Based on the link identification rule, the link content of the message to be detected of the abnormal message suspected user is identified to obtain a second link identification result, and based on the second link identification result, the abnormal message suspected user is determined as a key monitoring object.

[0008] According to an abnormal message identification method provided by the present invention, the method further includes: Inputting the image of the target user's message to be detected into the image recognition model to obtain a first image recognition result output by the image recognition model; the first image recognition result is used to determine whether the image of the target user's message to be detected is a sensitive image; Determining the target user as a suspected user of abnormal messages based on the first image recognition result; The image recognition model is trained based on sample images and sample image recognition result labels corresponding to the sample images.

[0009] According to an abnormal message identification method provided by the present invention, after determining that the target user is a suspected abnormal message user based on the comparison result of the matching identical number of times and the preset safety number threshold, or after identifying the link content of the target user's to-be-detected message based on the link identification rule to obtain a first link identification result, and determining that the target user is a suspected abnormal message user based on the first link identification result, the method further includes: Inputting the image of the message to be detected of the suspected abnormal message user into the image recognition model to obtain a second image recognition result output by the image recognition model; Based on the second image recognition result, the suspected user of abnormal message is determined as a key monitoring target.

[0010] According to an abnormal message recognition method provided by the present invention, the image recognition model is trained based on the following method: Input the sample image into the image recognition model to obtain the sample image recognition result output by the image recognition model; Input the sample image recognition result and the sample image recognition result label into a loss function for calculation to obtain a loss value; the loss function includes a classification loss function and a regression loss function, and the sum of the weights between the classification loss function and the regression loss function is 1; The image recognition model is trained based on the loss value.

[0011] The present invention also provides an abnormal message identification device, comprising: A sensitive word matching module, used to obtain a message to be detected sent by a target user terminal, and determine the matching results between the message keywords of the message to be detected and each sensitive word in a preset sensitive word set; the preset sensitive word set includes a first-level sensitive word set and a second-level sensitive word set; the target user terminal is configured to receive an operation instruction of the target user; A matching number determination module is used to determine the number of identical matches based on each of the matching results; the number of identical matches includes the first-level identical matches and the second-level identical matches; the first-level identical matches are the number of identical matches between the message keywords of the message to be detected and each sensitive word in the first-level sensitive word set; the second-level identical matches are the number of identical matches between the message keywords of the message to be detected and each sensitive word in the second-level sensitive word set; An abnormal message identification module is used to determine that the target user is a suspected abnormal message user based on the comparison result of the number of identical matches with a preset safety number threshold; the preset safety number threshold includes a first-level safety number threshold and a second-level safety number threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level number of identical matches with the first-level safety number threshold, and the second comparison result is obtained by comparing the second-level number of identical matches with the second-level safety number threshold.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the abnormal message identification method described in any one of the above methods is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the abnormal message identification method as described in any one of the above is implemented.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the abnormal message identification method described in any one of the above is implemented.

[0015] The abnormal message identification method, device, electronic device, product and storage medium provided by the present invention obtain a message to be detected sent by a target user terminal, determine the matching results of the message keywords of the message to be detected with each sensitive word in a preset sensitive word set; the preset sensitive word set includes a first-level sensitive word set and a second-level sensitive word set, and the sensitivity of each sensitive word in the first-level sensitive word set is greater than the sensitivity of each sensitive word in the second-level sensitive word set; the target user terminal is configured to receive an operation instruction of the target user; based on each of the matching results, the number of identical matches is determined; the number of identical matches includes a first-level identical match number and a second-level identical match number; the first-level identical match number is the number of identical matches between the message keywords of the message to be detected and each sensitive word in the first-level sensitive word set; the second-level identical match number is the number of identical matches between the message keywords of the message to be detected and each sensitive word in the second-level sensitive word set; based on the comparison result of the identical match number and a preset safety number threshold, determine that the target user is a suspected user of an abnormal message; the preset safety number threshold It includes a first-level safety times threshold and a second-level safety times threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level matching number of the same times with the first-level safety times threshold, and the second comparison result is obtained by comparing the second-level matching number of the same times with the second-level safety times threshold; the present invention divides the sensitive word set into a first-level and a second-level sensitive word set, and matches the keywords in the message to be detected with these two types of sensitive words respectively. This sensitive word sensitivity graded matching mechanism can evaluate the sensitivity of the message at different levels, thereby improving the level of refinement of the detection; by counting the number of matches, the system can quantify the frequency of occurrence of sensitive words in the message, and compare it with the preset safety times threshold, so as to avoid misjudgment of a single sensitive word and improve the accurate identification of abnormal message behavior; by setting different thresholds, the present invention can flexibly adjust the response degree to sensitive words of different levels, and this mechanism can more comprehensively judge whether the message has an abnormal message risk, thereby reducing the probability of misjudgment of normal behavior and improving the accuracy and reliability of identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 This is one of the flow charts of the abnormal message identification method provided by the present invention.

[0018] Figure 2This is the second flow chart of the abnormal message identification method provided by the present invention.

[0019] Figure 3 This is the third flow chart of the abnormal message identification method provided by the present invention.

[0020] Figure 4 This is the fourth flow chart of the abnormal message identification method provided by the present invention.

[0021] Figure 5 This is the fifth flow chart of the abnormal message identification method provided by the present invention.

[0022] Figure 6 This is the sixth flow chart of the abnormal message identification method provided by the present invention.

[0023] Figure 7 It is a schematic diagram of the picture recognition result of the abnormal message recognition method provided by the present invention.

[0024] Figure 8 It is a structural schematic diagram of the abnormal message identification device provided by the present invention.

[0025] Fig. 9 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] As an increasingly complex fraud method, abnormal messages pose a major threat to the property safety and personal privacy of the public. Traditional anti-abnormal message methods include restricting the caller and callee of the target number, discovering users with abnormal behavior, and manual monitoring by the operator's customer service. The applicant found that, first of all, the disadvantages of restricting the caller and callee of the target number are that first, it is necessary to be based on the premise that the number has been reported to have abnormal behavior, and it is necessary to further verify whether the user actually has abnormal behavior. The whole process takes a long time, which reduces the real-time nature of the telecommunications anti-abnormal message action; secondly, the method of discovering users with abnormal behavior identifies the user's abnormal message behavior from two aspects: voice monitoring and short message text recognition, but it is necessary to monitor the suspected user number in real time and uninterruptedly on the network equipment network management system, which wastes a lot of labor costs; thirdly, the method of manual monitoring by the operator's customer service refers to the real-time monitoring of user behavior, call content, short message content, etc. after receiving the report that the user has abnormal message behavior. Although the coverage is comprehensive and the consideration is more thoughtful, the labor cost invested is too high, and when the labor is tired after working for a long time, there may be a risk of misjudgment, which is easy to cause user complaints.

[0028] The applicant further discovered that the use of SMS sensitive content recognition technology to automatically analyze SMS content and use preset rules to identify potential abnormal behavior can reduce a lot of labor costs, but there are still problems that cannot be ignored; SMS sensitive content recognition technology is used to identify the content of SMS sent by users. For example, if the content of the short message involves sensitive words such as "bank card transfer", "bank card password", "ID card information", etc., necessary measures will be taken for the number. However, when the user really needs to transmit bank card information or identity information to other users, SMS sensitive content recognition technology is prone to the risk of misjudgment, resulting in restrictions on users who perform normal behaviors, thereby causing complaints from users.

[0029] In view of the above problems, the present invention proposes the following embodiments.

[0030] Figure 1 is a flow chart of the abnormal message identification method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 110, obtaining the message to be detected sent by the target user terminal, and determining the matching results of the message keywords of the message to be detected with each sensitive word in the preset sensitive word set; the preset sensitive word set includes a first-level sensitive word set and a second-level sensitive word set, and the sensitivity of each sensitive word in the first-level sensitive word set is greater than the sensitivity of each sensitive word in the second-level sensitive word set; the target user terminal is configured to receive the operation instructions of the target user.

[0031] Here, the message to be detected refers to the message content sent by the target user, and the message content is analyzed and detected to identify whether it contains potential abnormal messages; message keywords refer to important words or phrases extracted from the message to be detected. These message keywords are used to match sensitive words in the preset sensitive word set to determine whether the message has abnormal risks.

[0032] Here, the preset sensitive word set is a predefined set of words, which is a word set graded according to the sensitivity of sensitive words, and is used to improve the accuracy and efficiency of abnormal message detection; through the refined management and matching analysis of primary and secondary keywords, this method can better identify and prevent various types of abnormal message behaviors, thereby protecting the safety of users. The primary sensitive word set contains specific and detailed sensitive words, which are used to identify specific types of abnormal messages or sensitive information in specific contexts. These words are usually more targeted and professional. The secondary sensitive word set contains general sensitive words, which are usually more common and are used to detect a wide range of abnormal message patterns.

[0033] Specifically, this method will match the message keywords in the message to be detected with the preset sensitive word library. Through this matching, this method can identify whether the message to be detected contains highly sensitive content, so as to evaluate whether it may involve abnormal message behavior. For example, if multiple first-level keywords appear in the message, this method may mark it as a high-risk message; if only second-level keywords appear, this method may mark it as a low-risk message, but it still needs attention.

[0034] It should be understood that this method detects users who dial a large number of numbers or send and receive a large number of messages in a short period of time, and will list such users as monitoring objects, ie, target users.

[0035] It should be noted that the number of messages to be detected is not limited. Regardless of whether the target user sends a single message or multiple messages, each message is identified as a message to be detected one by one. In addition, the number of message keywords of the messages to be detected is also not limited. This method will extract the message keywords of each message to be detected and match them with the sensitive words in the sensitive word library.

[0036] It should be understood that the matching of the message keywords of the message to be detected with each preset sensitive word in the preset sensitive word set is a cumulative process; the matching result is also a cumulative result, not just the result of matching a single message to be detected.

[0037] Specifically, the matching results of each message to be detected will be accumulated in the overall analysis, and the keywords of each message to be detected will be compared with the preset sensitive word set. This is a one-by-one matching process. This method will record the matching of each message and summarize the matching results of all messages to be detected, thereby forming a cumulative matching data, that is, the final matching result. Therefore, the matching result not only reflects the situation of a single message, but also reflects the comprehensive matching of all messages to be detected. In the subsequent steps, the accumulated matching results are used for further analysis. For example, the keywords of each message to be detected of the target user are matched with the sensitive words in the sensitive word set, and the matching results of each message to be detected are accumulated to obtain a comprehensive matching result. This method determines the total number of identical matches from the comprehensive matching results, thereby judging whether the total number of identical matches exceeds the preset threshold, and then judging whether the user is involved in abnormal messages.

[0038] Through this cumulative matching process, this method can more accurately evaluate the overall behavior pattern of the target user, thereby improving the ability to detect abnormal message behavior. This method can effectively reduce the misjudgment caused by insufficient single message matching, thereby providing a basis for providing more comprehensive and accurate abnormal message identification results in the future.

[0039] In one embodiment, further identification is performed on the text message content of the target user, and all messages sent by the target user are determined to be messages to be detected, and then keyword extraction is performed on the messages to be detected to obtain message keywords of the messages to be detected; further, the message keywords of the messages to be detected and the matching results of each preset sensitive word in the preset sensitive word set are confirmed, and the matching results will be used for further analysis to determine whether the message may involve an abnormal message.

[0040] Among them, the preset sensitive word set includes a first-level sensitive word set and a second-level sensitive word set, so that the present invention can perform more detailed analysis according to different sensitive word levels; the first-level sensitive word set processes more sensitive words, and the second-level sensitive word set processes a wide range of common words. Such a hierarchical approach can improve the detection capability of complex abnormal message patterns, avoid missed detection and misjudgment, and improve the accuracy of recognition. By carefully matching the keywords in the message to be detected, potential abnormal messages can be more accurately identified.

[0041] Of course, the preset sensitive word set can be divided into more sensitivity levels depending on the specific situation, which will not be elaborated here.

[0042] Exemplarily, the preset sensitive word set is divided into primary sensitive words and secondary sensitive words according to the sensitivity. Primary sensitive words: amount, bank card, transfer, account number, ID card, recharge, password, etc.; secondary sensitive words: package, refund, e-commerce platform, merchant name, etc. The present invention can identify a variety of messages, including 5G messages.

[0043] Exemplarily, the present invention can use an unsupervised keyword extraction LDA algorithm with strong applicability and low cost to extract the text content in 5G messages. The unsupervised extraction algorithm needs to select a way to evaluate keywords, such as the frequency and position of the word, so as to extract message keywords in this way. Many abnormal messages may use vague or outdated names, such as "industry and commerce" and "commerce", which may no longer be standardized names. Therefore, when extracting keywords, it is necessary to consider the rule of fuzzy abbreviations and standardized abbreviations. In addition, the content of most abnormal information has obvious characteristics. By identifying these obvious abnormal characteristics, it is possible to directly judge whether it is abnormal from the content of the message without complex technical means. Again, people who send abnormal messages often use typos to circumvent sensitive word checks. The intention of people who send abnormal messages is to use these non-standardized characters and spellings to evade detection by keyword matching methods and increase the concealment of abnormal information. Therefore, it is necessary to combine text content analysis and pattern recognition technology to deal with various techniques and circumvention strategies.

[0044] Of course, other keyword extraction algorithms may also be used to extract the message to be detected, which will not be described in detail here.

[0045] Step 120, based on each of the matching results, determine the number of identical matches; the number of identical matches includes the first-level identical matches and the second-level identical matches; the first-level identical matches are the number of times the message keywords of the message to be detected are matched with each sensitive word in the first-level sensitive word set; the second-level identical matches are the number of times the message keywords of the message to be detected are matched with each sensitive word in the second-level sensitive word set.

[0046] Here, the number of identical matches refers to the number of times the keywords in the message to be detected match the same words in the preset sensitive word set. This process is divided into two levels. The first-level identical matches refers to the number of identical matches between the keywords in the message to be detected and each sensitive word in the first-level sensitive word set; the second-level identical matches refers to the number of identical matches between the keywords in the message to be detected and each sensitive word in the second-level sensitive word set. It should be noted that the calculation of the number of identical matches is a cumulative process. Through the matching results, the matching situation between the keywords of each message to be detected and the preset sensitive word set can be determined. This also means that when the keywords extracted from each message to be detected match the sensitive words in the preset sensitive word set, the number of identical matches will be gradually accumulated, rather than just calculating the number of identical matches for a single message.

[0047] Exemplarily, when processing the message to be detected, keywords are extracted from the message text. For example: Message 1 to be detected: "Discount users need to set a password to ensure account security", Message 2 to be detected: "Please change your password in time to prevent leakage", then the keywords extracted from Message 1 to be detected are: "discount", "user", "password"; then the keywords extracted from Message 2 to be detected are: "please", "change", "password", "leak". This method compares each keyword in each message to be detected with a preset sensitive word set. For message keywords that exist in the sensitive word set, this method will record the same number of matches once. Specifically, if the keyword "password" in Message 1 to be detected exists in the preset first-level sensitive word set, the first-level sensitive word of this message has the same number of matches as 1, and because the keyword "password" in Message 2 to be detected is successfully matched with the preset first-level sensitive word set again, the same number of matches for "password" will be updated to 2 times, that is, the same number of matches is 2, and so on. In other words, for each new message to be detected, this method will compare the message keywords with the preset sensitive word set again, and accumulate the same number of matches to the previous records, so that the final matching result can fully reflect the frequency of occurrence of sensitive content in the message to be detected. This accumulation method helps to more accurately assess the abnormal risk of the message, improve the overall accuracy of the detection of this method, and prevent misjudgment.

[0048] Step 130, based on the comparison result of the same number of matches with a preset safety number threshold, determine that the target user is a suspected user of abnormal messages; the preset safety number threshold includes a first-level safety number threshold and a second-level safety number threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level same number of matches with the first-level safety number threshold, and the second comparison result is obtained by comparing the second-level same number of matches with the second-level safety number threshold.

[0049] Here, the preset safety frequency threshold is the frequency threshold used to determine whether the user is suspected of abnormality. It is divided into level one and level two, corresponding to sensitive words of different severity. The level one safety frequency threshold refers to the frequency threshold compared with the level one sensitive words, which is usually set lower because the content involved in the level one sensitive words is usually more serious. The preset level two safety frequency threshold is the frequency threshold compared with the level two sensitive words, which is relatively high because the content involved in the level two sensitive words is usually less relevant to the abnormality and can be left for subsequent observation. Therefore, the preset level two safety frequency threshold will be set higher to prevent misjudgment.

[0050] Here, the first comparison result is the result determined by comparing the same number of first-level matches with a preset first-level safety number threshold, and the second comparison result is the result determined by comparing the same number of second-level matches with a preset second-level safety number threshold.

[0051] Specifically, this method comprehensively considers the first comparison result and the second comparison result. As long as any one of the two comparison results exceeds its corresponding preset safety times threshold, the target user can be marked as a suspected user of abnormal messages. That is to say, if the same number of first-level matches exceeds the first-level safety times threshold, or if the same number of second-level matches exceeds the preset second-level safety times threshold, the target user is considered to be abnormally suspected. This judgment method can ensure a more comprehensive risk assessment of users. Even if the number of sensitive word matches in a certain category is small, but the number of sensitive word matches in another category exceeds the threshold, this method can identify potential abnormal behavior in a timely manner. This can more effectively capture possible abnormal risks.

[0052] like Figure 4 As shown, Figure 4 Used to demonstrate the specific process of determining that the target user is a suspected user of abnormal messages based on the comparison result of the matching identical number of times and the preset safety number threshold.

[0053] In one embodiment, as long as any one of the first comparison result and the second comparison result exceeds its corresponding preset safety times threshold, the target user can be marked as a suspected user of abnormal messages.

[0054] Exemplarily, message keywords are extracted from the message to be detected, and these keywords are fully compared with the sensitive word set established in advance. The sensitive word set includes a first-level sensitive word set and a second-level sensitive word set. If the number of matches between the message keywords of the message to be detected and the first-level sensitive word set is the same 3 times, and the first-level safety threshold is also 3 times, the target user is immediately marked as a suspected user of abnormal messages. If the number of matches between the keywords of the message to be detected and the second-level sensitive word set is 3 times, and the second-level safety threshold is also 5 times, it means that the second-level matching number of times reaches the preset second-level safety threshold, and the user's 5G message behavior is included in further monitoring, and the current second-level matching number of the target user is recorded as 3 times. When the subsequent second-level sensitive word matching number of the user reaches 5 times, the target user is marked as a suspected user of abnormal messages. This judgment logic ensures comprehensive monitoring and accurate identification of user message behavior, and prevents the risk of misjudgment through sensitive word matching and accumulation mechanisms at different levels, and can more effectively identify and manage potential abnormal risks.

[0055] In another embodiment, if any one of the first comparison result and the second comparison result exceeds the corresponding preset safety times threshold, the target user can be marked as a suspicious user; when the number of times the target user is marked as a suspicious user exceeds the safety times threshold for suspicious users, the target user is determined to be a suspected user of abnormal messages. This method can avoid misjudgment through step-by-step screening and provide a buffer period for users. Through multiple marking and accumulation strategies, only after the user has been marked as a suspicious user multiple times will he be finally determined as a suspected user of abnormal messages, which can effectively reduce the misjudgment rate and reduce the impact on normal users.

[0056] The abnormal message identification method provided by the embodiment of the present invention divides the sensitive word set into a primary and a secondary sensitive word set, and matches the keywords in the message to be detected with the two types of sensitive words respectively. This sensitive word sensitivity graded matching mechanism can evaluate the sensitivity of the message at different levels, thereby improving the level of refinement of detection; by counting the number of matches, the method can quantify the frequency of occurrence of sensitive words in the message, and compare it with a preset safety number threshold, which can avoid misjudgment of a single sensitive word and improve the accurate identification of abnormal message behavior; by setting different thresholds, the present invention can flexibly adjust the response degree to sensitive words of different levels. This mechanism can more comprehensively judge whether the message has abnormal risks, thereby reducing the probability of misjudgment of normal behavior and improving the accuracy and reliability of identification.

[0057] Based on any of the above embodiments, the method further includes: Identify the link content of the target user's message to be detected based on the link identification rule to obtain a first link identification result, and determine that the target user is a suspected user of abnormal messages based on the first link identification result; Among them, the link identification rules include abnormal domain name identification rules and abnormal location identification rules. The abnormal domain name identification rules are used to identify the abnormal domain name of the link content, and the abnormal location identification rules are used to identify the abnormal location of the website corresponding to the link content.

[0058] Here, the link identification rules are preset. The link identification rules are used to analyze the link content in the target user's message to be detected. This rule includes abnormal domain name identification rules and abnormal location identification rules. Abnormal domain name identification is to determine whether the domain name in the link content belongs to the abnormal range. Abnormal domain names usually refer to those that are different from common and trusted domain names. They may contain uncommon characters, spelling errors, or domain name suffixes that do not meet expectations. Abnormal location identification is to detect the geographical location of the website pointed by the link. If the location of the website does not match its declared business scope or legality, it may be a sign of fraud. For example, a link claiming to be a domestic bank shows that the location is overseas, which may indicate its fraudulent nature.

[0059] Here, the first link identification result is the output result of link content identification, which is used to determine the legitimacy and credibility of the link. The reliability of the link is evaluated by identifying abnormal domain names or abnormal locations.

[0060] Of course, the link identification rules of the present invention may also include but are not limited to link redirection check, link content analysis, HTTPS protocol verification and user behavior analysis, etc. Other link identification rules different from the embodiments of the present invention should be regarded as equivalent replacements and do not depart from the protection scope of the present invention. Link redirection check refers to tracking the redirection chain in the link. If the link jumps through multiple redirections, it may be an attempt to conceal the final destination or commit fraud; link content analysis refers to analyzing whether the content of the web page pointed to by the link contains keywords related to common abnormal activities, such as "winning", "free gifts", etc., verifying the content of the web page to ensure that it is consistent with the actual description of the legitimate business and avoid misleading users; HTTPS protocol verification refers to checking whether the HTTPS certificate used by the website is valid and whether it is issued by a trusted certificate authority to avoid man-in-the-middle attacks or forged certificates, and ensuring that the domain name on the certificate is consistent with the domain name actually visited; user behavior analysis refers to analyzing the frequency of user clicks on links, and abnormally high click-through rates may be caused by malicious activities. These link identification rules can be combined and applied according to actual needs to provide multi-level link security detection. This comprehensive detection not only improves the accuracy of identifying abnormal links, but also effectively protects users from potential network attacks and abnormal behavior threats.

[0061] like Figure 5 As shown, Figure 5 It is used to demonstrate the specific process of identifying the link content of the target user's message to be detected based on the preset link identification rules.

[0062] In one embodiment, the link content of the target user's message to be detected is identified based on a preset link identification rule to obtain a first link identification result, and whether the target user is a suspected user of abnormal messages is judged based on this first link identification result. If the link content of the target user's message to be detected violates the preset link identification rule, the target user is judged as a suspected user of abnormal messages.

[0063] Exemplarily, the link content in the 5G message is identified, including the domain name of the link, because most of the domain names in the abnormal information have the following characteristics: the link is a mixture of uppercase and lowercase letters and numbers, the domain name ending is incomplete, etc. The domain name of a regular website ends with ".cn". By analyzing the composition of the link's URL, if ".cn" does not appear in the link and the link content is a mixture of uppercase and lowercase letters and numbers, it is determined to be a suspicious URL. Further, the authenticity of the website is identified, and the IP address attribution query tool is used to query the attribution of the link IP. If the IP is displayed as an overseas address, the registration status of the website is continued to be queried. If the link is not registered, it is determined to be an abnormal website, and the message to be detected is determined to be abnormal information, and the target user is listed as a suspected user of abnormal messages.

[0064] The abnormal message identification method provided by the embodiment of the present invention can effectively identify potential abnormal risks by identifying the link content in the target user's message to be detected. Abnormal domain names are often common features in abnormal activities. Abnormal activities often use uncommon or forged domain names to circumvent normal security checks. By identifying these abnormal domain names, potential abnormal links can be quickly discovered and the ability to identify malicious links can be enhanced; secondly, by detecting the abnormal attribution of the link, the suspiciousness of the link can be further confirmed, and legitimate links in normal activities can be effectively excluded.

[0065] Based on any of the above embodiments, in the method, after determining that the target user is a suspected user of abnormal messages based on the comparison result of the number of identical matches and the preset safety number threshold, the method further includes: Based on the link identification rule, the link content of the message to be detected of the abnormal message suspected user is identified to obtain a second link identification result, and based on the second link identification result, the abnormal message suspected user is determined as a key monitoring object.

[0066] Here, the abnormal message suspect user refers to the target user who is initially determined to be likely to be involved in abnormal behavior. The key monitoring object refers to the abnormal message suspect user who is confirmed to have a high abnormal risk after further link content detection and will be listed as the key focus object for stricter monitoring and analysis.

[0067] In one embodiment, for the messages to be detected that have been marked as suspected users of abnormal messages, the method further identifies the link content in these messages to be detected based on the link identification rules, thereby generating a second link identification result. If the second link identification result shows that the link content of the user is abnormal, the user is further marked as a key monitoring target. This means that the target user will be subject to stricter monitoring and review in order to more deeply analyze its potential abnormal activities.

[0068] The abnormal message identification method provided by the embodiment of the present invention significantly improves the accuracy of abnormal message identification through a multi-level detection mechanism. After initially screening out suspected message users through keyword matching, further abnormal detection is performed on the links in their messages, effectively reducing the risk of misjudgment. By identifying abnormal domain names and website locations, potential abnormal message activities can be accurately located, and these users can be marked as key monitoring targets. This method not only enhances the ability to detect abnormal behavior, but also optimizes the allocation of monitoring resources, making the tracking and prevention of high-risk users more effective, thereby improving the overall abnormal message protection level.

[0069] Based on any of the above embodiments, the method further includes: Inputting the image of the target user's message to be detected into the image recognition model to obtain a first image recognition result output by the image recognition model; the first image recognition result is used to determine whether the image of the target user's message to be detected is a sensitive image; Determining the target user as a suspected user of abnormal messages based on the first image recognition result; The image recognition model is trained based on sample images and sample image recognition result labels corresponding to the sample images.

[0070] Here, the image recognition model is trained to recognize and classify the content in an image. The training uses labeled sample images, that is, images with known labels, and the model learns how to extract features from these images and classify them.

[0071] Here, sensitive images refer to those that contain important information or private data, such as bank card numbers, ID photos, payment receipts, etc. These images often appear in abnormal message activities and therefore require special attention and protection.

[0072] like Figure 6 As shown, Figure 6 Used to demonstrate the process of identifying the target user as a suspected user of abnormal messages when the image of the message to be detected is a sensitive image.

[0073] In one embodiment, if it is determined based on the first image recognition result that the image of the target user's message to be detected is a sensitive image, the target user is determined as a suspected user of abnormal messages.

[0074] In another embodiment, when the picture of the target user's message to be detected is a sensitive picture, the picture of the target user's message to be detected is stored in a sensitive picture set; based on the comparison result of the number of sensitive pictures in the sensitive picture set and the preset sensitive picture number threshold, the target user is determined to be a suspected user of abnormal messages.

[0075] Here, the sensitive picture set is used to store a collection of pictures identified as sensitive. The preset sensitive picture quantity threshold refers to a pre-set quantity value used to determine whether the number of sensitive pictures reaches a certain level. If the threshold is reached or exceeded, it can be determined that the user may be involved in abnormal message behavior.

[0076] Exemplarily, the category of the picture in the 5G message is determined, that is, the picture category of the message to be detected is determined; if the picture is identified as one of an ID card, a QR code, a package, or a courier slip, the message to be detected is determined to be an abnormal message, and the user who sends the message to be detected is determined to be a suspected user of an abnormal message.

[0077] The abnormal message identification method provided by the embodiment of the present invention inputs the picture in the message to be detected into a trained picture recognition model, and the model can analyze the picture content and output the recognition result. The result is used to determine whether the picture is of a sensitive type, such as important information such as a bank card or ID card. Based on these judgments, if the picture is determined to be sensitive, the target user is further marked as a suspected user of abnormal messages; by combining picture recognition with traditional text analysis, this method can more comprehensively detect potential abnormal behaviors and provide more accurate and efficient security protection.

[0078] Based on any of the above embodiments, in the method, after determining that the target user is a suspected user of abnormal messages based on the comparison result of the number of identical matches and the preset safety number threshold, or after identifying the link content of the target user's to-be-detected message based on the link identification rule to obtain a first link identification result, and determining that the target user is a suspected user of abnormal messages based on the first link identification result, the method further includes: Inputting the image of the message to be detected of the suspected abnormal message user into the image recognition model to obtain a second image recognition result output by the image recognition model; Based on the second image recognition result, the suspected user of abnormal message is determined as a key monitoring target.

[0079] like Figure 2 As shown, Figure 2 Used to demonstrate the process of identifying target users as key monitoring objects.

[0080] In one embodiment, after the target user is determined to be a suspected user of abnormal messages based on the comparison result of the same number of matches with a preset safety number threshold, that is, the target user's message to be detected has a same number of matches with a preset sensitive word set that exceeds the preset safety number threshold, and is thus determined to be a suspected user of abnormal messages, on this basis, the picture of the target user's message to be detected is further input into the picture recognition model to obtain a second picture recognition result output by the picture recognition model; based on the second picture recognition result, it is determined that the picture of the target user's message to be detected is a sensitive picture, and the user is further marked as a key monitoring object.

[0081] The benefit of this is that the image recognition model can effectively detect sensitive information or abnormal content in the image, further verify the abnormal behavior of the suspected user of the abnormal message, improve the accuracy of recognition, and prevent misjudgment. Combining image recognition with other recognition methods can effectively focus monitoring resources on users who are most likely to engage in abnormal behavior and avoid excessive monitoring of harmless users.

[0082] In another embodiment, after identifying the link content of the target user's message to be detected based on the link identification rule, obtaining a first link identification result, and determining that the target user is a suspected user of abnormal messages based on the first link identification result, that is, the link content of the target user's message to be detected does not meet the link identification rule, and the target user has been determined as a suspected user of abnormal messages, on this basis, further inputting the image of the target user's message to be detected into the image recognition model to obtain a second image recognition result output by the image recognition model; based on the second image recognition result, determining that the image of the target user's message to be detected is a sensitive image, further marking the user as a key monitoring object. Through the double check of the link content and the image content, it is possible to reduce the situation where normal users are mistakenly marked as key monitoring objects, thereby reducing misjudgments and avoiding restrictive measures against users who perform normal behaviors, thereby causing user complaints.

[0083] like Figure 3 As shown, Figure 3 Used to demonstrate the process of restricting the communication permissions of key monitored objects.

[0084] In the above embodiment, the abnormal message identification method provided by the present method includes text content anomalies, message link anomalies and image anomalies; specifically, text content anomaly refers to the fact that the keywords of the target user's message to be detected match the preset sensitive word set the same number of times exceeding the preset safety number threshold, thereby being determined as an abnormal message suspected user; message link anomaly refers to the fact that the link content of the target user's message to be detected does not comply with the link identification rules, thereby being determined as an abnormal message suspected user; image anomaly refers to the fact that the image of the target user's message to be detected is a sensitive image, thereby being determined as an abnormal message suspected user; if the target user implements any two of the text content anomaly, message link anomaly and image anomaly, the target user is marked as a key monitoring object; further, if the key monitoring object implements any one of the text content anomaly, message link anomaly and image anomaly again, the communication authority of the key monitoring object is restricted.

[0085] It should be noted that as long as the key monitored object performs any of the abnormal behaviors again, its communication rights will be immediately restricted. This measure avoids excessive monitoring of normal users and improves the accuracy and response speed of abnormal message identification.

[0086] The abnormal message identification method provided by the embodiment of the present invention realizes multi-level abnormal identification by simultaneously considering the three abnormal forms of text content abnormality, message link abnormality and image abnormality. By comparing the behavior of the target user with multiple abnormal standards and marking it as a key monitoring object only when any two abnormal behaviors are met, the probability of misjudgment can be significantly reduced. For example, a simple text content match may misjudge a legitimate message as an abnormal message, while combining the recognition of message links and pictures can increase the accuracy, thereby reducing the misjudgment of normal users. By marking users who have implemented any two abnormal behaviors as key monitoring objects, resources can be concentrated to monitor their behavior in detail to prevent further abnormal activities. This centralized monitoring method ensures the effective use of resources and can quickly respond to potential abnormal threats.

[0087] Based on any of the above embodiments, in this method, the image recognition model is trained based on the following method: Input the sample image into the image recognition model to obtain the sample image recognition result output by the image recognition model; Input the sample image recognition result and the sample image recognition result label into a loss function for calculation to obtain a loss value; the loss function includes a classification loss function and a regression loss function, and the sum of the weights between the classification loss function and the regression loss function is 1; The image recognition model is trained based on the loss value.

[0088] In one embodiment, a sample image is input into an image recognition model, and the model analyzes the image and outputs a sample image recognition result. The sample image recognition result generally includes the classification or regression of the image content by the model, the classification includes determining whether the image contains sensitive information, and the regression includes predicting a specific numerical value in the image; further, the recognition result output by the image recognition model is compared with the actual sample image recognition result label, and input into a loss function for calculation to obtain a loss value; the loss function is used to measure the difference between the model prediction result and the true label; the loss function includes a classification loss function and a regression loss function, and the sum of the weights between the classification loss function and the regression loss function is 1; further, based on the calculated loss value, the image recognition model is trained. Through an optimization algorithm, such as gradient descent, the parameters of the model will be adjusted to minimize the loss value, thereby improving the model's recognition accuracy of the image content.

[0089] Specifically, by setting the sum of the weights of the classification loss function and the regression loss function to 1, we can ensure that the losses of the two tasks are reasonably combined and weighed during the training process. This prevents the loss of a certain task from excessively dominating the model training, making the model more balanced when performing multiple tasks, ensuring that the image recognition model performs more comprehensively and stably when processing multiple tasks, so that it can better cope with complex image recognition tasks in practical applications.

[0090] Exemplarily, before training the image recognition model, an image training sample library will be established first, and images of ID cards, QR codes, parcels, and express orders will be obtained through network images, open source training libraries, etc. Due to the shooting scene of the picture, the influence of lighting, the influence of pixels, different angles, etc., various differences will appear in the image, which will have a significant impact on the detection results of the deep learning model. Therefore, when establishing an image training sample library, in order to ensure the integrity of the sample library, it is necessary to collect as many images of ID cards, QR codes, parcels, and express orders as possible in various states. Due to the limitation of the image source, the collected ID card, QR code, parcel, and express order images cannot contain all situations, so the ID card, QR code, parcel, and express order images need to be data enhanced. The data can be amplified from the following aspects: image rotation, random cropping, horizontal flipping, vertical flipping, stretching, scaling, etc. After the ID card, QR code, parcel, and express order images are amplified, the robustness of the data set can be enhanced. Since the image recognition of ID cards, QR codes, parcels, and express orders is susceptible to noise interference, in order to resist the interference from noise in the image, the images in the data set are subjected to median filtering. Median filtering is a nonlinear filter that can effectively protect the edge information of the image while reducing image noise. Next, the fault location of the amplified and preprocessed data set is marked with a marking tool to establish a VOC data set. Each image corresponds to an XML file, which stores the label value of the image mark and the coordinate position information of the target object.

[0091] Exemplarily, the image recognition model trained in the present invention uses a Faster RCNN (Fast Regional Convolutional Neural Network) network based on RestNet101 (Fast Training Residual Network), which mainly includes: the convolution process from conv featuremap to intermediate layer, RPN (Region Proposal Network) network, and RoiHead classification process.

[0092] First, extract the feature information of the image of the message to be detected to obtain a feature map, and use the convolution kernel to slide on the feature map to convert the convolution feature map into an intermediate layer feature map. The convolution process generates different feature maps through multiple convolution kernels, and the generated feature map is used for subsequent region proposal and classification. Specifically, a 3*3 sliding window is slid on the feature map, and the feature map extracted by this sliding window is 3×3×256 in size. For a certain point on the feature map, 256 convolution kernels of size 3×3×256 are used to convolve this window. The convolution process is obviously corresponding to the channel (256 channels) convolution to obtain a 1×256-dimensional vector, and then accumulate to obtain a 1×1 vector. There are 256 convolution kernels, so there are 256 such vectors. The final result is 1×256 (here 256 is the number of convolution kernels, the number of input channels of the convolution function determines the number of channels of the convolution kernel, and the number of convolution kernels determines the number of output channels), and the result corresponds to the intermediate layer structure. Secondly, the 256-dimensional vector of the intermediate layer corresponds to two branches, namely the Cls-layer (classification) branch and the Reg-layer branch (regression branch); in the Cls-layer (classification) branch of Faster RCNN, a 1×1×256×18 convolution kernel is used to operate the feature map to classify each candidate box. Among the 18 scores finally output, every 9 scores represent the probability of the foreground and background of a candidate box, and these scores are used to determine whether each candidate box contains a target. In the Reg-layer branch (regression branch), the Reg-layer branch predicts the position parameters of each candidate box through regression operation. These predicted values ​​are used to adjust the position of the candidate box so that it matches the position of the target object more accurately. The 1×1×256×36 convolution kernel performs a convolution operation on the feature map to generate a regression value for each candidate box so that the position of the candidate box can be corrected in the final target detection.

[0093] Secondly, there is a mapping relationship between the feature map after convolution and the original image. RPN uses the feature map to generate proposals, and through this mapping relationship, maps the proposals on the feature map back to the original image, thereby obtaining the location information of the proposals. Anchor refers to a point on the feature map (usually the center of the sliding window) corresponding to a certain area on the original image. Each anchor represents a position on the feature map, and there will be multiple anchors of different scales and aspect ratios at this position. These proposals are used to detect targets of different sizes and proportions. Assume that the size of the feature map is 13×13×256. This means that the feature map has a spatial size of 13×13 and 256 channels, and a 3×3 convolution kernel is used to perform convolution operations on the feature map. Due to the use of boundary padding, each point on the feature map can be used as the center point of the convolution kernel. In this way, the convolution on the feature map will produce 13×13 convolution centers, each center point corresponds to an anchor; each convolution center point (pixel point) has 9 anchors of different scales and aspect ratios. Therefore, a total of 13×13×9 = 1521 candidate boxes will be generated, which is enough to cover all areas on the original image, and even a large number of repeated areas. In addition, the process of sliding the window on the feature map is similar to the inverse process of SPP (SPP is a pooling method), that is, the input areas of different sizes are derived from the fixed size of the feature map. The anchor is the center position of each window (sliding window) on the feature map, representing the corresponding area on the original image. Through the sliding window and anchor, a large number of candidate regions (proposals) can be obtained. These candidate regions are obtained from the feature map according to their position and size, and each proposal is assigned a position parameter.

[0094] It should be understood that the main task of RPN is to generate candidate regions (proposals) from feature maps, which may contain targets. RPN generates classification (foreground or background) and regression (target location) information for each candidate region by applying convolution operations to feature maps. The classification convolution layer (i.e., the classification branch) is responsible for predicting whether the candidate box contains the target foreground or background, and the regression convolution layer (i.e., the regression branch) is responsible for predicting the location and size of the candidate box. The number of channels in the classification convolution layer is 2K, because each anchor corresponds to K candidate boxes, and each candidate box has two categories: foreground and background. The number of channels in the regression convolution layer is 4K, because each anchor corresponds to K candidate boxes, and each candidate box has 4 position parameters. With this structure, RPN can effectively generate high-quality candidate regions and provide useful information for subsequent target detection.

[0095] Again, the RPN training process stipulates that there are positive samples and negative samples. Positive samples refer to anchors with the maximum IoU (Intersection over Union) with the ground truth box (real annotation box) and are marked as positive samples. These anchors are considered to be potential target areas; negative samples refer to anchors with an IoU less than 0.3 with the ground truth box and are marked as negative samples. These anchors are considered to be background areas and do not contain targets. IoU (Intersection over Union) is an indicator used to measure the degree of overlap between two bounding boxes. The higher the IoU, the larger the overlapping area of ​​the two boxes; further, the loss function for training RPN is defined as follows:

[0096] Among them, i represents the i-th anchor in the mini-batch. Indicates the probability that the i-th anchor is the foreground. When the i-th anchor is the foreground, is 1, otherwise it is 0. Represents the coordinates of the predicted bounding box, is the ground truth coordinate.

[0097] In the process of generating proposals, the foreground probability and position parameters of the anchor are calculated. For each image, the feature map is used to calculate the foreground probability and position regression parameters of each anchor. Assuming the size of the feature map is H / 16×W / 16×9 (for example, about 20,000 anchors), each anchor has a foreground probability and a regression position parameter; 12,000 anchors with larger foreground probabilities are selected from all anchors as candidate regions. This is done to ensure the quality of the candidate regions and avoid selecting regions with too low probabilities; the positions of these 12,000 anchors are corrected using the regression position parameters to make them closer to the actual target region. These corrections are based on the coordinates output by the regression convolution layer; further, from the corrected 12,000 anchors, NMS (non-maximum suppression) is used to select the final 2,000 RoIs (regions of interest). These RoIs (regions of interest) will be further classified and regressed in the future.

[0098] Next, 128 of these RoIs are selected as samples for subsequent processing. These sample RoIs will be used for the actual classification and regression tasks in the training process, and all RoI feature maps are uniformly pooled to a fixed 7×7 size. This is to enable RoIs of different sizes to be converted into feature maps of the same size for further processing. Classification and regression of RoIs involves passing feature maps through a fully connected convolutional network, using a softmax (classification layer) layer for classification, and predicting bounding box coordinates through a linear regression layer.

[0099] It should be noted that the total loss function is divided into classification loss and regression loss. The classification loss uses softmax loss, and the number of categories is the number of foreground categories and the number of background categories. The calculation formula is as follows:

[0100] The regression loss is to directly predict each corresponding x, y, w, h. The background class does not participate in the regression loss calculation, as shown in the following formula:

[0101] ; ; ; ; ; ; ; ; ; ; ; in, When it is a positive sample, it is 1, and when it is a negative sample, it is 0; Represents the bounding box regression parameters predicted by the i-th anchor; Represents the bounding box regression parameters of the GT corresponding to the i-th anchor.

[0102] The total loss of RPN is the weighted sum of classification loss and regression loss, as shown in the following formula:

[0103] in, Indicates the number of all samples in the mini-batch 256; Indicates the number of anchor positions, which is approximately 2400; Indicates the probability that the i-th anchor is predicted to be the true label; Indicates that the GT of the i-th anchor is 1 when it is a positive sample and 0 when it is a negative sample; Represents the bounding box regression parameters predicted by the i-th anchor; Represents the bounding box regression parameters of the GT corresponding to the i-th anchor.

[0104] During training, grid points are used to represent a bounding box in object detection. Nine grid points can be used, which are distributed at the four corners and the center points of the four edges of the image. These grid points are used to predict the key points of the target on the heat map. ROI Align (Region of Interest Align) is a technique used in object detection tasks to align feature maps in candidate regions (RoIs) to fixed-size feature maps. Here, each ROI (region of interest) is operated through ROIAlign to obtain a fixed-size (14×14) feature map. Then, after 8 3×3 dilated convolutions, the receptive field is expanded to extract richer features. After 2 deconvolutions (upsampling), the resolution of the feature map is increased to 56×56, generating 9 56×56 heat maps, each of which corresponds to the location of a key point. These heat maps are converted into probability maps through the Sigmoid function. Each heat map has a corresponding supervision map (GT), which uses the cross (5 pixels) of the target key point on the original image as a positive sample. The map (GT) and the predicted heat map are used to calculate the binary cross entropy loss for training the model so that the predicted key point position is as close to the actual position as possible. The regression problem is converted into a classification problem based on each point in the heat map. During inference, the pixel with the highest confidence is selected on each probability map and its coordinates are mapped to the original image. The calculation formula is as follows: ; ; Among them, H represents the coordinates of the pixel point on the heat map, I represents the coordinates of the grid point on the original image, and P represents the coordinates of the upper left corner of the candidate area extracted by RPN on the original image. , represents the size of the candidate region, , Indicates the size of the heat map. According to the above formula, the coordinates of the grid points on the original image are equal to the coordinates of the pixel points on the heat map multiplied by the scaling factor from the candidate region to the heat map plus the translation of the candidate region. Next, a prediction box is determined by the 9 grid points of a candidate region.

[0105] ; ; ; ; in, , , , : left, right, up, down. E: one of the four edges. j comes from the nth point of the edge. The coordinates of the jth point, The probability value of the j-th point on the probability graph; The prediction box of the final target is calculated by the coordinate values ​​predicted by the network. The four parameters of network regression are known. , , , , given the center coordinates x, y, width and height of the candidate box. Obtained by the selective search algorithm , , , The four coordinates can be used to get the final prediction box through the following formula: ; ; ; ; If the accuracy of the candidate box is not enough, the overlap area with the correct bounding box will be small, and the candidate box needs to be corrected. Here, the linear ridge regression algorithm is used as a regressor to refine each type of target and generate the final prediction result. When predicting, the probability of all RoIs is calculated, and the position of the predicted candidate box is adjusted using the position parameter, and then the overlapping suggestion box is removed using non-maximum suppression (NMS): find the target with the highest score in each category, calculate the IoU (intersection over union) value of other bounding boxes and the target, and delete the bounding box compared with the highest scoring bounding box if it is greater than the threshold, because there must be many bounding boxes in these bounding boxes that have the same category. By performing the NMS operation, other bounding boxes with the same category as the highest scoring bounding box can be deleted to avoid repeated representation of the same category. The reason why the highest scoring candidate box is not directly retained is that the IoU (intersection over union) value of some boxes with the highest scoring box does not exceed the threshold, indicating that this box represents other categories. If it is deleted directly, the candidate box representing other categories may be deleted by mistake.

[0106] like Figure 7 As shown, Figure 7 Shows examples of image recognition results obtained with the image recognition model.

[0107] Finally, the above model is trained to obtain weights, and the collected ID card, QR code, package, and express delivery slip images are pre-processed and then identified using the trained image recognition model to determine whether they are one of the ID card, QR code, package, and express delivery slip images. When the 5G message sent by the user involves the above sensitive image information, the target user is identified as a suspected abnormal message user.

[0108] The abnormal message identification device provided by the present invention is described below. The abnormal message identification device described below and the abnormal message identification method described above can be referred to each other.

[0109] Figure 8 A schematic diagram of the structure of the abnormal message identification device provided by the present invention, as shown in Figure 8 As shown, the abnormal message identification device includes: The sensitive word matching module 810 is used to obtain the message to be detected sent by the target user terminal, and determine the matching results between the message keywords of the message to be detected and each sensitive word in the preset sensitive word set; the preset sensitive word set includes a primary sensitive word set and a secondary sensitive word set, and the sensitivity of each sensitive word in the primary sensitive word set is greater than the sensitivity of each sensitive word in the secondary sensitive word set; the target user terminal is configured to receive an operation instruction of the target user; The matching number determination module 820 is used to determine the matching number of times based on each of the matching results; the matching number of times includes the first-level matching number of times and the second-level matching number of times; the first-level matching number of times is the number of times the message keyword of the message to be detected matches the same number of times each sensitive word in the first-level sensitive word set; the second-level matching number of times is the number of times the message keyword of the message to be detected matches the same number of times each sensitive word in the second-level sensitive word set; The abnormal message identification module 830 determines that the target user is a suspected abnormal message user based on the comparison result of the number of identical matches with a preset safety number threshold; the preset safety number threshold includes a first-level safety number threshold and a second-level safety number threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level number of identical matches with the first-level safety number threshold, and the second comparison result is obtained by comparing the second-level number of identical matches with the second-level safety number threshold.

[0110] Fig. 9 An example of a physical structure diagram of an electronic device is shown in FIG. Fig. 9As shown, the electronic device may include: a processor 910, a communication interface 920, a memory 930 and a communication bus 940, wherein the processor 910, the communication interface 920 and the memory 930 communicate with each other through the communication bus 940. The processor 910 may call the logic instructions in the memory 930 to execute the abnormal message identification method, which includes: obtaining the message to be detected sent by the target user terminal, and determining the matching results of the message keywords of the message to be detected and each sensitive word in the preset sensitive word set; the preset sensitive word set includes a first-level sensitive word set and a second-level sensitive word set, and the sensitivity of each sensitive word in the first-level sensitive word set is greater than the sensitivity of each sensitive word in the second-level sensitive word set; the target user terminal is configured to receive the operation instruction of the target user; based on each of the matching results, determine the number of identical matches; the number of identical matches includes the first-level identical matches and the second-level identical matches; the first-level identical matches are the number of identical matches of the message to be detected. The target user is determined to be a suspected user of abnormal messages based on the comparison result of the number of identical matches between the target user and each sensitive word in the first-level sensitive word set; the second-level identical matches are the number of identical matches between the target user and each sensitive word in the second-level sensitive word set; the target user is determined to be a suspected user of abnormal messages based on the comparison result of the number of identical matches between the target user and each sensitive word in the second-level sensitive word set; the preset safety number threshold includes a first-level safety number threshold and a second-level safety number threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level identical matches with the first-level safety number threshold, and the second comparison result is obtained by comparing the second-level identical matches with the second-level safety number threshold.

[0111] In addition, the logic instructions in the above-mentioned memory 930 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0112] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the abnormal message identification method provided by the above-mentioned methods, which includes: obtaining a message to be detected sent by a target user terminal, and determining the matching results of the message keywords of the message to be detected with each sensitive word in a preset sensitive word set; the preset sensitive word set includes a first-level sensitive word set and a second-level sensitive word set, and the sensitivity of each sensitive word in the first-level sensitive word set is greater than the sensitivity of each sensitive word in the second-level sensitive word set; the target user terminal is configured to receive an operation instruction of the target user; based on each of the matching results, determining the number of identical matches; the number of identical matches includes a first-level sensitive word set and a second-level sensitive word set. The same number of matches and the same number of secondary matches; the first-level same number of matches is the number of times the message keywords of the message to be detected are matched with each sensitive word in the first-level sensitive word set; the second-level same number of matches is the number of times the message keywords of the message to be detected are matched with each sensitive word in the second-level sensitive word set; based on the comparison result of the same number of matches and the preset safety number threshold, the target user is determined to be a suspected user of abnormal messages; the preset safety number threshold includes a first-level safety number threshold and a second-level safety number threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level same number of matches with the first-level safety number threshold, and the second comparison result is obtained by comparing the second-level same number of matches with the second-level safety number threshold.

[0113] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the abnormal message identification method provided by the above-mentioned methods, the method comprising: obtaining a message to be detected sent by a target user terminal, and determining the matching results of the message keywords of the message to be detected with each sensitive word in a preset sensitive word set; the preset sensitive word set comprises a first-level sensitive word set and a second-level sensitive word set, and the sensitivity of each sensitive word in the first-level sensitive word set is greater than the sensitivity of each sensitive word in the second-level sensitive word set; the target user terminal is configured to receive an operation instruction of the target user; based on each of the matching results, determining the number of identical matches; the number of identical matches comprises the first-level identical matches and the second-level identical matches number; the first-level matching identical times is the number of times the message keywords of the message to be detected are matched identically with each sensitive word in the first-level sensitive word set; the second-level matching identical times is the number of times the message keywords of the message to be detected are matched identically with each sensitive word in the second-level sensitive word set; based on the comparison result of the matching identical times and the preset safety times threshold, the target user is determined to be a suspected user of abnormal messages; the preset safety times threshold includes a first-level safety times threshold and a second-level safety times threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level matching identical times with the first-level safety times threshold, and the second comparison result is obtained by comparing the second-level matching identical times with the second-level safety times threshold.

[0114] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0115] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying abnormal messages, characterized in that: include: Obtaining a message to be detected sent by a target user terminal, and determining a matching result between a message keyword of the message to be detected and each sensitive word in a preset sensitive word set; The preset sensitive word set includes a primary sensitive word set and a secondary sensitive word set, and the sensitivity of each sensitive word in the primary sensitive word set is greater than the sensitivity of each sensitive word in the secondary sensitive word set; The target user terminal is configured to receive an operation instruction from a target user; Based on each of the matching results, determine the number of identical matches; the number of identical matches includes the first-level identical matches and the second-level identical matches; the first-level identical matches are the number of identical matches between the message keywords of the message to be detected and each sensitive word in the first-level sensitive word set; the second-level identical matches are the number of identical matches between the message keywords of the message to be detected and each sensitive word in the second-level sensitive word set; Based on the comparison result of the matching identical times and the preset safety times threshold, determining that the target user is a suspected user of abnormal messages; The preset safety times threshold includes a first-level safety times threshold and a second-level safety times threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level matching same times with the first-level safety times threshold, and the second comparison result is obtained by comparing the second-level matching same times with the second-level safety times threshold.

2. The abnormal message identification method according to claim 1, characterized in that: The method further comprises: Identify the link content of the target user's message to be detected based on the link identification rule to obtain a first link identification result, and determine that the target user is a suspected user of abnormal messages based on the first link identification result; Among them, the link identification rules include abnormal domain name identification rules and abnormal location identification rules. The abnormal domain name identification rules are used to identify the abnormal domain name of the link content, and the abnormal location identification rules are used to identify the abnormal location of the website corresponding to the link content.

3. The abnormal message identification method according to claim 2, characterized in that: After determining that the target user is a suspected user of abnormal messages based on the comparison result of the number of identical matches with the preset safety number threshold, the method further includes: Based on the link identification rule, the link content of the message to be detected of the abnormal message suspected user is identified to obtain a second link identification result, and based on the second link identification result, the abnormal message suspected user is determined as a key monitoring object.

4. The abnormal message identification method according to claim 2, characterized in that: The method further comprises: Inputting the image of the target user's message to be detected into the image recognition model to obtain a first image recognition result output by the image recognition model; the first image recognition result is used to determine whether the image of the target user's message to be detected is a sensitive image; Determining the target user as a suspected user of abnormal messages based on the first image recognition result; The image recognition model is trained based on sample images and sample image recognition result labels corresponding to the sample images.

5. The abnormal message identification method according to claim 4, characterized in that: After determining that the target user is a suspected abnormal message user based on the comparison result of the number of identical matches and the preset safety number threshold, or after identifying the link content of the target user's to-be-detected message based on the link identification rule to obtain a first link identification result, and determining that the target user is a suspected abnormal message user based on the first link identification result, the method further includes: Inputting the image of the message to be detected of the suspected abnormal message user into the image recognition model to obtain a second image recognition result output by the image recognition model; Based on the second image recognition result, the suspected user of abnormal message is determined as a key monitoring target.

6. The abnormal message identification method according to claim 4, characterized in that: The image recognition model is trained based on the following method: Input the sample image into the image recognition model to obtain the sample image recognition result output by the image recognition model; Input the sample image recognition result and the sample image recognition result label into a loss function for calculation to obtain a loss value; the loss function includes a classification loss function and a regression loss function, and the sum of the weights between the classification loss function and the regression loss function is 1; The image recognition model is trained based on the loss value.

7. An abnormal message identification device, characterized in that: include: A sensitive word matching module is used to obtain a message to be detected sent by a target user terminal, and determine a matching result between a message keyword of the message to be detected and each sensitive word in a preset sensitive word set; The preset sensitive word set includes a first-level sensitive word set and a second-level sensitive word set; The target user terminal is configured to receive an operation instruction from a target user; A matching number determination module is used to determine the number of identical matches based on each of the matching results; the number of identical matches includes the first-level identical matches and the second-level identical matches; the first-level identical matches are the number of identical matches between the message keywords of the message to be detected and each sensitive word in the first-level sensitive word set; the second-level identical matches are the number of identical matches between the message keywords of the message to be detected and each sensitive word in the second-level sensitive word set; An abnormal message identification module, used to determine that the target user is a suspected abnormal message user based on the comparison result of the matching number of times and a preset safety number threshold; The preset safety times threshold includes a first-level safety times threshold and a second-level safety times threshold; the comparison result includes a first comparison result and a second comparison result, the first comparison result is obtained by comparing the first-level matching same times with the first-level safety times threshold, and the second comparison result is obtained by comparing the second-level matching same times with the second-level safety times threshold.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the abnormal message identification method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal message identification method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the abnormal message identification method according to any one of claims 1 to 6 is implemented.

Images