Abnormal short message behavior detection method and system based on multi-dimensional feature fusion

Abstract

The invention discloses an abnormal short message behavior detection method and system based on multi-dimensional feature fusion, and relates to the related technical field of short message security detection.The method comprises the steps that spatial and temporal distribution features, semantic association maps and equipment behavior fingerprints of short message interaction are collected, a dynamic feature pool is configured, and a cross-modal feature sequence is extracted; cascade identification is carried out; the feature fusion weight matrix is dynamically adjusted, an abnormal probability score is generated, and when the abnormal probability score exceeds a dynamic abnormal probability threshold, a multi-stage verification mechanism is triggered; and matching a time sequence mode at an edge computing node, dynamically generating a verification code triggering threshold value, performing interactive risk verification, and determining an abnormal short message behavior mark. The technical problems of insufficient detection timeliness and adaptability and high false alarm and missing report rate caused by single detection dimension and difficulty in identifying novel complex abnormal short message behaviors in the prior art are solved, and the technical effects of reducing the false alarm and missing report rate of short message anomaly detection and improving the detection timeliness and adaptability are achieved.

Description

Technical Field

[0001] The present application relates to the technical field related to SMS security detection, and specifically to a method and system for detecting abnormal SMS behavior based on multi-dimensional feature fusion. Background Art

[0002] As an important information transmission channel, SMS has been continuously expanded in application scenarios, from daily social communication to financial transaction verification, enterprise information push, etc. However, the accompanying abnormal SMS behaviors, such as spam SMS group sending, telecommunications fraud SMS, malicious deduction SMS, etc., are becoming increasingly serious. Traditional abnormal SMS detection methods are mostly based on single-dimensional feature analysis, such as identifying spam SMS by keyword matching, or judging abnormalities based on simple rules such as SMS sending frequency. However, with the development of technology, criminals use semantic obfuscation, disguised sending sources and other means to evade detection, making the false alarm rate and missed alarm rate of single feature detection methods high; at the same time, due to the complexity and dynamic nature of SMS behavior, relying solely on static features is difficult to adapt to diverse attack scenarios, difficult to accurately identify new abnormal SMS behavior patterns, and unable to achieve efficient and accurate detection of abnormal SMS behavior.

[0003] Therefore, in the current relevant technologies, there are technical problems such as single detection dimension and difficulty in identifying new and complex abnormal SMS behaviors, which leads to insufficient detection timeliness and adaptability and high false alarm and missed alarm rates. Summary of the invention

[0004] This application solves the technical problems in the prior art of single detection dimension, difficulty in identifying new and complex abnormal SMS behaviors, insufficient detection timeliness and adaptability, and high false alarm and omission rates by providing an abnormal SMS behavior detection method and system based on multi-dimensional feature fusion. This achieves the technical effect of reducing the false alarm and omission rates of SMS anomaly detection and improving detection timeliness and adaptability.

[0005] This application provides an abnormal SMS behavior detection method based on multi-dimensional feature fusion. The method includes: collecting the spatio-temporal distribution features, semantic association graph, and device behavior fingerprints of SMS interactions, configuring a dynamic feature pool, and extracting cross-modal feature sequences through a sliding time window to determine the mutual information entropy and abnormal deviation degree between each feature dimension; uploading the mutual information entropy and abnormal deviation degree between each feature dimension to a central computing node for cascaded recognition. The central computing node includes a feature selection layer based on an attention mechanism, a temporal dependence analysis layer, and an adversarial sample filtering layer; dynamically adjusting the feature fusion weight matrix according to the cascaded recognition result to generate an abnormal probability score. When the abnormal probability score exceeds the dynamic abnormal probability threshold, a multi-stage verification mechanism is triggered; using the multi-stage verification mechanism, matching the temporal pattern in the user's historical behavior baseline at the edge computing node, dynamically generating a verification code trigger threshold, and performing interactive risk verification in combination with context scenario features to determine the abnormal SMS behavior mark.

[0006] In a possible implementation manner, the abnormal SMS behavior detection method based on multi-dimensional feature fusion further performs the following processing: parsing the syntactic dependency tree of the SMS text to extract the semantic conflict index; capturing the high-frequency operation behaviors in the device operation sequence based on the semantic conflict index to generate a behavior pattern coding vector; fusing the base station positioning trajectory and the IP address jump feature according to the behavior pattern coding vector to construct a spatio-temporal abnormal topology graph; performing tensor splicing on the behavior pattern coding vector and the spatio-temporal abnormal topology graph to configure the dynamic feature pool.

[0007] In a possible implementation manner, the abnormal SMS behavior detection method based on multi-dimensional feature fusion further performs the following processing: using asymmetric KL divergence to quantify the distribution difference between the semantic association graph and the device behavior fingerprint, and performing quantile mutation detection on the feature values within the sliding time window to configure the local outlier factor of the spatio-temporal distribution feature; based on the local outlier factor of the spatio-temporal distribution feature, mapping the temporal feature to a two-dimensional matrix through Gram angle field transformation to extract the spatial correlation feature, and the spatial correlation feature is used to dynamically correct the edge weights of the spatio-temporal abnormal topology graph.

[0008] In a possible implementation, the abnormal SMS behavior detection method based on multi-dimensional feature fusion further performs the following processing: using a multi-head self-attention mechanism to assign weights to the cross-modal feature sequence, and introducing a differentiable feature gating unit to filter redundant dimensions according to the feature contribution degree to obtain initially screened selected features; based on the initially screened selected features, jointly optimizing the GRU hidden state of the time series dependence analysis layer and the attention weights to construct a feature embedding space immune to adversarial perturbations; in the feature embedding space, determining the mutual information gradient between feature channels, and combining the confidence score of the resistance sample filtering layer to generate a non-linear feature importance mask in the cascaded recognition result.

[0009] In a possible implementation, the abnormal SMS behavior detection method based on multi-dimensional feature fusion further performs the following processing: constructing a generative adversarial network, which is used to simulate the feature distribution of an attacker forging normal samples; identifying potential adversarial samples through the confidence difference output by the discriminator, and adopting a feature reconstruction error and gradient mask strategy to suppress the gradient propagation of the potential adversarial samples.

[0010] In a possible implementation, the abnormal SMS behavior detection method based on multi-dimensional feature fusion further performs the following processing: inserting a gradient reversal layer after the last convolutional layer of the discriminator to dynamically adjust the gradient direction and force the adversarial samples to form a gradient flat area in the latent space.

[0011] In a possible implementation, the abnormal SMS behavior detection method based on multi-dimensional feature fusion further performs the following processing: determining a threshold baseline value according to the time decay factor of historical abnormal events; based on the threshold baseline value, combining the current network environment risk level and user identity credibility, introducing a dynamic offset coefficient, and smoothly updating the dynamic abnormal probability threshold.

[0012] In a possible implementation, the abnormal SMS behavior detection method based on multi-dimensional feature fusion further performs the following processing: deploying edge computing nodes based on the central computing node to perform distributed feature preprocessing on the dynamic feature pool, and dynamically offloading computing tasks according to the device resource status; through the offloaded computing tasks, configuring a lightweight detection sub-process; using the lightweight detection sub-process to establish a local caching mechanism on the edge computing node, and the local caching mechanism is used to perform local interception operations.

[0013] In a possible implementation, the abnormal SMS behavior detection method based on multi-dimensional feature fusion further performs the following processing: using LSH (Locality-Sensitive Hashing) to establish a behavior query index; based on the behavior query index, determining context scenario features, where the context scenario features include GPS trajectory clustering labels and application process CPU occupancy rate fluctuations; according to the context scenario features, combining historical behavior baseline data, dynamically adjusting the similarity fluctuation range, and if the similarity score does not meet the similarity threshold under the similarity fluctuation range, triggering the local interception operation.

[0014] This application also provides an abnormal SMS behavior detection system based on multi-dimensional feature fusion. The system includes: a cross-modal feature sequence extraction module, which is used to collect the spatio-temporal distribution features, semantic association graphs, and device behavior fingerprints of SMS interactions, configure a dynamic feature pool, and extract cross-modal feature sequences through a sliding time window to determine the mutual information entropy and abnormal deviation degree between each feature dimension; a cascaded recognition module, which is used to upload the mutual information entropy and abnormal deviation degree between each feature dimension to a central computing node for cascaded recognition. The central computing node includes a feature selection layer based on an attention mechanism, a temporal dependence analysis layer, and an adversarial sample filtering layer; an abnormal probability score generation module, which is used to dynamically adjust the feature fusion weight matrix according to the cascaded recognition result and generate an abnormal probability score. When the abnormal probability score exceeds the dynamic abnormal probability threshold, triggering a multi-stage verification mechanism; an abnormal SMS behavior marking determination module, which is used to, with the multi-stage verification mechanism, match the temporal pattern in the user's historical behavior baseline at the edge computing node, dynamically generate a verification code trigger threshold, and perform interactive risk verification in combination with context scenario features to determine the abnormal SMS behavior marking.

[0015] It is intended to collect the spatio-temporal distribution features, semantic association graphs, and device behavior fingerprints of SMS interactions, configure a dynamic feature pool, and extract cross-modal feature sequences through the abnormal SMS behavior detection method and system based on multi-dimensional feature fusion proposed in this application; perform cascaded recognition; dynamically adjust the feature fusion weight matrix to generate an abnormal probability score. When the abnormal probability score exceeds the dynamic abnormal probability threshold, trigger a multi-stage verification mechanism; match the temporal pattern at the edge computing node, dynamically generate a verification code trigger threshold, and perform interactive risk verification to determine the abnormal SMS behavior marking. This solves the technical problems in the prior art, such as single detection dimension, difficulty in identifying new and complex abnormal SMS behaviors, resulting in insufficient detection timeliness and adaptability, and high false alarm and missed detection rates, and achieves the technical effects of reducing the false alarm and missed detection rates of SMS anomaly detection and improving the detection timeliness and adaptability. Description of the Drawings

[0016] To more clearly illustrate the technical solutions of the embodiments of the present disclosure, the accompanying drawings of the embodiments of the present disclosure will be briefly introduced below. Flowcharts are used in this application to illustrate the operations performed by the systems according to the embodiments of the present application. It should be understood that the operations above or below do not necessarily need to be performed precisely in sequence. Instead, according to needs, they can be performed in reverse order or simultaneously. At the same time, other operations can also be added to these processes, or one or several operations can be removed from these processes.

[0017] Figure 1 Schematic flowchart of the abnormal SMS behavior detection method based on multi-dimensional feature fusion provided by the embodiments of the present application.

[0018] Figure 2 Schematic structural diagram of the abnormal SMS behavior detection system based on multi-dimensional feature fusion provided by the embodiments of the present application.

[0019] Explanation of reference numerals: cross-modal feature sequence extraction module 10, cascaded recognition module 20, abnormal probability score generation module 30, abnormal SMS behavior marking determination module 40. Detailed implementation manners

[0020] The above description is only an overview of the technical solutions of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present application more obvious and understandable, the following specifically gives the detailed implementation manners of the present application.

[0021] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations of the present application. All other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present application.

[0022] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments. However, it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments and can be combined with each other without conflict. The terms "first / second" involved are only used to distinguish similar objects and do not represent a specific order for the objects. The terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server comprising a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or modules not clearly listed or inherent to these processes, methods, products or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application.

[0023] Embodiments of this application provide an abnormal SMS behavior detection method based on multi-dimensional feature fusion, as Figure 1 shown. The method includes: Step S100, collect the spatio-temporal distribution features, semantic association graph and device behavior fingerprints of SMS interactions, configure a dynamic feature pool, and extract cross-modal feature sequences through a sliding time window, and determine the mutual information entropy and abnormal deviation degree between each feature dimension.

[0024] Preferably, collect the spatio-temporal distribution features, semantic association graph and device behavior fingerprints of SMS interactions. Among them, the spatio-temporal distribution features include time distribution features and space distribution features. The time distribution features mainly include information such as the time points and time intervals of SMS sending and receiving. For example, a certain number sends a large number of SMS messages frequently in a short period of time, or there are abnormal SMS interaction behaviors during a specific time period (such as the early morning inactive time). The space distribution feature refers to the geographical location information of both parties in the SMS interaction, and the approximate locations of the sender and receiver can be obtained through methods such as the base station positioning of the mobile phone and the IP address. For example, if the location of the SMS sender shows a large span in a short period of time, or a large number of SMS messages are concentrated in a specific area, etc., these all reflect the characteristics of the space distribution.

[0025] Preferably, perform semantic analysis on the SMS content to construct a semantic association graph. Specifically, extract the keywords and entities (such as personal names, place names, organization names, etc.) in the SMS and analyze the relationships between them, such as inclusion relationship, parallel relationship, causal relationship, etc. Through the semantic association graph, the meaning of the SMS content can be understood more deeply, and some hidden semantic patterns can be discovered. For example, some fraudulent SMS may revolve around specific themes (such as winning a prize, taking a loan, etc.) and mention relevant keywords and entities multiple times in the content. Through the semantic association graph, such SMS with specific semantic features can be identified more clearly. Collect device behavior fingerprints. Specifically, each device generates some unique behavior characteristics during use, which can be used as the "fingerprint" of the device. For example, the device model, operating system version, screen resolution, sensor data (such as accelerometer, gyroscope data), network connection method (such as Wi-Fi, 4G, 5G), etc. By collecting device-related information, a device behavior model can be established. Different device behavior patterns may reflect different usage scenarios or abnormal situations. For example, if the same account performs SMS interactions from multiple devices with different behavior fingerprints in a short period of time, it may be abnormal.

[0026] Preferably, uniformly store various features such as the spatio-temporal distribution characteristics, semantic association graph, and device behavior fingerprints of the SMS into a dynamic feature pool, that is, configure a dynamic feature pool, and update it as new SMS interaction data is continuously collected to adapt to the changing SMS behavior patterns; then use a sliding time window to select data in the dynamic feature pool at a certain time interval. Within each time window, combine features of different modalities (spatio-temporal distribution, semantics, device behavior, etc.) to form a cross-modal feature sequence, including combining the time and space information of SMS interactions within a specific time window, the semantic features of the SMS content, and the device behavior fingerprints and other features together as a complete feature sequence, so as to capture the mutual relationships and changing trends between different features over a period of time.

[0027] Preferably, mutual information entropy is used to measure the degree of dependence and information sharing between different feature dimensions. The higher the mutual information entropy, the closer the relationship between two feature dimensions, and the more overlapping information they contain. Specifically, for feature dimensions such as the spatio-temporal distribution characteristics, semantic association graph, and device behavior fingerprint of SMS interactions, for example, for the time feature, a day can be divided into several time periods, and the frequency of SMS events occurring in each time period can be counted as the probability; for the space feature, geographical locations can be divided into different regions, and the probability of SMS interactions in each region can be calculated, etc. First, they are quantified and discretized to facilitate the calculation of the probability distribution, then the joint probability distribution of the two feature dimensions and their respective marginal probability distributions are calculated, and then the mutual information entropy of the two feature dimensions is calculated according to the formula of mutual information entropy. By calculating the mutual information entropy between feature dimensions, it can be understood which features are strongly correlated, so as to better utilize these relationships to identify abnormal behaviors.

[0028] Preferably, the current value of each feature dimension is compared with the historical normal value range, and the degree of deviation from the normal range, that is, the abnormal deviation degree, is calculated to determine whether the current feature value is abnormal. If the abnormal deviation degree of a certain feature dimension is large, it indicates that the feature has changed in a way that does not conform to the normal situation, which may be abnormal SMS behavior. Specifically, first, it is necessary to establish the historical behavior baseline of each feature dimension. For the spatio-temporal distribution characteristics of SMS interactions, according to data such as the time pattern and spatial distribution range of normal SMS interactions in the past period, determine its normal value range and change trend; for the semantic association graph, analyze the semantic feature distribution of normal SMS content, such as the occurrence frequency of keywords, the type of semantic relationship, etc., and establish a normal semantic model; for the device behavior fingerprint, determine the normal value interval of each device attribute according to the device's previous normal usage patterns and behavior characteristics. Then, statistical quantities such as the standard deviation or coefficient of variation are used to calculate the degree of deviation between the current feature value and the historical behavior baseline, so as to more accurately identify abnormal behaviors.

[0029] Furthermore, step S100 further includes step S110 of parsing the syntactic dependency tree of the SMS text and extracting the semantic conflict index; step S120 of capturing the high-frequency operation behaviors in the device operation sequence based on the semantic conflict index and generating a behavior pattern coding vector; step S130 of fusing the base station positioning trajectory and the IP address jump feature according to the behavior pattern coding vector to construct a spatio-temporal anomaly topology map; step S140 of performing tensor splicing on the behavior pattern coding vector and the spatio-temporal anomaly topology map to configure the dynamic feature pool.

[0030] Preferably, through natural language processing technology, analyze the SMS text to determine the grammatical roles of each word in the sentence and their dependency relationships, such as subject-predicate-object, attributive-adverbial-complement relationships, etc., so as to construct a syntactic dependency tree. Among them, the syntactic dependency tree is a tree structure representing the grammatical relationships between words in a sentence, which can clearly display the grammatical structure of the sentence and help understand the semantics of the SMS. Then, further analyze the semantic relationships between words in the syntactic dependency tree, that is, analyze and compare the semantics of relevant words in the syntactic dependency tree, and combine some predefined semantic rules and knowledge graphs to calculate the semantic conflict index reflecting the degree of semantic inconsistency or contradiction in the SMS text, which reflects the abnormality degree of the SMS content at the semantic level. For example, if the SMS mentions "I am in Shanghai, but I am also in Beijing at the same time", this spatial contradiction will lead to a relatively high semantic conflict index.

[0031] Preferably, if the semantic conflict index is relatively high, indicating that the SMS may be abnormal, further analyze the relevant device operation behaviors to see if there are abnormal operation patterns. Specifically, record the operations of the device during the interaction with the SMS, such as sending SMS, receiving SMS, opening the SMS application, copying, pasting, deleting the SMS, etc. By analyzing the operation sequence, count which operations occur frequently. For example, if a device frequently sends SMS with a high semantic conflict index or frequently deletes SMS in a short period of time, it may be related to abnormal SMS behavior. Then, digitize and encode the captured frequent operation behaviors to generate a behavior pattern encoding vector. Among them, each element may represent a specific operation behavior or a certain feature of the operation behavior, and further transform the operation behavior pattern of the device into a digital vector that can be processed and analyzed by a computer.

[0032] Preferably, based on the generated behavior pattern encoding vector, the base station positioning trajectory and the IP address jump feature are fused. Specifically, through the signal interaction between the mobile phone and the base station, the approximate geographical location information of the device is obtained to form a base station positioning trajectory. Then, the geographical location change of the device when sending and receiving text messages is analyzed, such as whether there is a large-scale position movement in a short time, or whether it appears in some abnormal geographical locations. The change of the IP address used by the device during text message-related network operations is observed. If the IP address frequently jumps between different network segments or geographical locations, it indicates that the device has abnormal network behavior, such as being possibly used for illegal text message mass sending or there being a network attack, etc. Then, the operation behavior characteristics represented by the behavior pattern encoding vector are combined with the base station positioning trajectory and the IP address jump feature to construct a spatio-temporal anomaly topology graph in a graphical manner. Among them, the nodes can represent different devices, geographical locations or operation behaviors and other elements, and the edges represent the relationships between these elements, such as the association between the device and the geographical location, the relationship between the operation behavior and the IP address change, etc. Through the spatio-temporal anomaly topology graph, the abnormal behavior patterns and relationships of the device in the spatio-temporal dimension can be intuitively displayed, helping to discover potential abnormal text message behaviors.

[0033] Preferably, the behavior pattern encoding vector and the spatio-temporal anomaly topology graph are tensor-concatenated, that is, the behavior pattern encoding vector and the spatio-temporal anomaly topology graph are converted into tensor forms, and then concatenated according to certain rules. Among them, a tensor is a mathematical structure that can represent multi-dimensional data. For example, the behavior pattern encoding vector is used as a one-dimensional tensor, and the spatio-temporal anomaly topology graph is represented as a two-dimensional or higher-dimensional tensor, and then they are concatenated in dimensions to form a comprehensive tensor containing the device operation behavior and spatio-temporal characteristics, thereby integrating different types and dimensions of features. Finally, the concatenated tensor is stored in the dynamic feature pool, and with the arrival of new text message data and device operation data, new feature tensors can be continuously updated and added; at the same time, the existing data in the feature pool can also be updated and deleted to ensure that the data in the feature pool can timely reflect the latest device behaviors and text message interactions, which is helpful for accurate text message anomaly detection and analysis.

[0034] Further, step S140 further includes step S141, using the asymmetric KL divergence to quantify the distribution difference between the semantic association graph and the device behavior fingerprint, and performing quantile mutation detection on the eigenvalue within the sliding time window to configure the local outlier factor of the spatio-temporal distribution feature; step S142, based on the local outlier factor of the spatio-temporal distribution feature, mapping the time series feature into a two-dimensional matrix through the Gram angular field transformation, and extracting the spatial correlation feature, and the spatial correlation feature is used to dynamically correct the edge weights of the spatio-temporal anomaly topology graph.

[0035] Preferably, the asymmetric KL divergence is used to quantify the distribution difference between the semantic association graph and the device behavior fingerprint. Among them, the KL divergence, also known as relative entropy, is used to measure the difference between two probability distributions. Specifically, the semantic association graph and the device behavior fingerprint are each regarded as a probability distribution. The asymmetric KL divergence means that the calculation direction is different, that is, the divergence from the semantic association graph to the device behavior fingerprint may be different from the divergence from the device behavior fingerprint to the semantic association graph. By calculating the KL divergence value, the difference degree of the two features in distribution is quantified. For example, if the probability distribution of some semantic features in the semantic association graph is very different from the probability distribution of the relevant features in the device behavior fingerprint, the KL divergence value will be larger, indicating that the difference between the two is significant and indicating that there are abnormal behaviors in the short message. Then, the method of sliding time window is used to operate on the time series data, that is, calculate its quantiles (such as median, quartiles, etc.) within each time window. The quantile mutation detection is to observe the changes of these quantiles between different time windows. If it is found that a certain quantile has a large mutation at a certain moment (compared with the historical change trend), it is considered that there may be an abnormal situation.

[0036] Preferably, finally, in combination with the previous quantile mutation detection, etc., the local outlier factor of each spatio-temporal distribution feature data point is comprehensively configured to better identify abnormal situations in the spatio-temporal dimension. Specifically, for the spatio-temporal distribution feature, the local outlier factor value is determined by calculating the density ratio of each data point relative to its neighborhood points. Among them, the local outlier factor is used to detect whether a data point is an outlier. If the local outlier factor value of a data point is significantly greater than 1, it means that the density difference between it and the surrounding neighborhood points is large, and it is very likely to be an outlier, that is, there may be an abnormality in the spatio-temporal distribution feature.

[0037] Preferably, for the temporal features related to spatio-temporal distribution (such as position changes and time interval changes in a time series), they are mapped into a two-dimensional matrix through the Gramian Angular Field (GAF) transformation. Herein, the GAF transformation is used to convert time series data into a two-dimensional image (in matrix form), which can retain the important features of the time series and present the distribution and relationship of the data from a spatial perspective. The elements in the two-dimensional matrix reflect certain correlations and features between different time points. Then, by calculating the statistics and eigenvalues in the matrix, the spatial correlation features of the two-dimensional matrix are extracted, which reflect the internal connection of the spatio-temporal distribution in the spatial dimension, such as the movement pattern between different positions of the device and the correlation of position changes. Finally, according to the extracted spatial correlation features, the weights of the edges in the spatio-temporal anomaly topology map are dynamically corrected. For example, if it is found that the spatial correlation between certain positions is strong, the weights of the edges connecting these positions in the topology map can be increased accordingly; conversely, if the correlation is weak, the weights can be decreased. Thus, the topology map can more accurately reflect the true relationship and abnormal conditions of the device in the spatio-temporal dimension, thereby improving the accuracy and reliability of anomaly detection.

[0038] Step S200: Upload the mutual information entropy and anomaly deviation degree between the respective feature dimensions to a central computing node for cascaded identification. The central computing node includes a feature selection layer based on an attention mechanism, a temporal dependence analysis layer, and an adversarial sample filtering layer.

[0039] Preferably, the mutual information entropy and anomaly deviation degree between the respective feature dimensions are uploaded to a central computing node. Herein, the central computing node is a unit with powerful computing capabilities and centralized processing functions, responsible for receiving data from each collection point or preprocessing module and performing computing processing to achieve the evaluation and anomaly detection of short messages. Cascaded identification is a phased and step-by-step identification method. Through the sequential processing of multiple levels or modules, the input data is deeply analyzed and identified to improve the accuracy and reliability of identification. Specifically, the data sequentially passes through different functional layers in the central computing node, and each layer has its specific tasks and functions, jointly completing the comprehensive analysis of the mutual information entropy and anomaly deviation degree, thereby identifying possible abnormal conditions or patterns.

[0040] Preferably, the central computing node includes a feature selection layer based on the attention mechanism, a temporal dependence analysis layer, and an adversarial sample filtering layer. Among them, the attention mechanism refers to the mechanism that mimics the human visual attention, enabling the model to automatically focus on the most important parts of the input data. When processing multi-dimensional feature data such as mutual information entropy and anomaly deviation degree, the attention mechanism can help the model dynamically allocate weights to different features, highlighting the features that contribute more to the final recognition result while weakening those less important features. The feature selection layer can use the attention mechanism to select the most representative and discriminative feature subset from a large number of feature dimensions. For example, among multiple mutual information entropy and anomaly deviation degree features, some features may be more closely related to abnormal behaviors. Through the feature selection layer, these key features can be selected, reducing the subsequent calculation amount while improving the model's ability to identify abnormal situations.

[0041] Preferably, there may be a certain dependence relationship between the mutual information entropy and anomaly deviation degree data in the time series, that is, the feature value at the current moment may be related to the feature values in the past or future. For example, the anomaly deviation degree may show a certain trend or periodic change over time, or there may be continuous abnormal fluctuations within a certain time period. The temporal dependence analysis layer mainly uses temporal analysis models such as recurrent neural networks (RNNs), long short-term memory networks (LSTMs), etc. to model the feature data in the time dimension, capture the long-term and short-term dependence information in the data, and thus better understand the changing law of features over time and discover potential abnormal patterns, such as suddenly emerging abnormal change trends or feature fluctuations that do not conform to historical laws, so as to more accurately identify the time and pattern of abnormal behaviors.

[0042] Preferably, adversarial samples refer to samples generated by making carefully designed small perturbations to normal samples, which may cause the model to produce incorrect prediction results, but still look like normal samples to humans. There may be some malicious attacks attempting to interfere with the normal operation of the system by generating adversarial samples, or abnormal data similar to adversarial samples may be generated due to some abnormal situations in the data collection and processing process; the adversarial sample filtering layer usually adopts adversarial sample detection and defense technologies, such as detection based on generative adversarial networks (GANs), to re-check the data processed by the feature selection layer and the temporal dependence analysis layer, for identifying and filtering out adversarial samples or abnormal data to ensure the accuracy and reliability of the final recognition result and prevent the model from being misled to produce incorrect judgments.

[0043] Further, step S200 further includes step S210, which uses a multi-head self-attention mechanism to assign weights to the cross-modal feature sequence, and introduces a differentiable feature gating unit to filter redundant dimensions according to the feature contribution degree to obtain the initially screened selected features; step S220, based on the initially screened selected features, jointly optimizes the GRU hidden state of the temporal dependence analysis layer and the attention weights to construct a feature embedding space immune to adversarial perturbations; step S230, in the feature embedding space, determines the mutual information gradient between feature channels, and combines the confidence scores of the resistance sample filtering layer to generate the non-linear feature importance mask in the cascaded recognition result.

[0044] Preferably, the multi-head self-attention mechanism allows the model to capture the relationships between features in different representation subspaces. For the cross-modal feature sequence (a sequence composed of different modal feature combinations such as the spatio-temporal distribution features of SMS interactions, semantic association graphs, and device behavior fingerprints), the multi-head self-attention mechanism calculates the attention scores of multiple heads in parallel. Each head captures the dependencies between features from different perspectives, and then splices or weights and combines the results to assign corresponding weights to each feature element in the cross-modal feature sequence, highlighting those parts that are more important for the overall feature representation. For example, when processing a combined sequence of spatio-temporal distribution features and semantic features, the multi-head self-attention mechanism can identify that in some cases, semantic features may be more critical for judging anomalies, thus giving higher weights to semantic features.

[0045] Preferably, a differentiable feature gating unit is further introduced to filter redundant dimensions according to the feature contribution degree. Among them, the differentiable feature gating unit can control whether a feature dimension passes according to the contribution degree of the feature, that is, according to the weight of each feature dimension and other relevant information (such as the variance and information entropy of the feature), calculate a gating value. If the gating value of a certain feature dimension is low, it means that this dimension makes less contribution to the overall feature representation and may be redundant. The gating unit will then reduce the weight of this dimension or directly filter it out, thereby reducing the number of feature dimensions, removing redundant information, improving the computational efficiency and generalization ability of the model, and finally obtaining the initially screened selected features.

[0046] Preferably, based on the initially screened and selected features obtained through the multi-head self-attention mechanism and the differentiable feature gating unit, specifically, the temporal dependence analysis layer uses a gated recurrent unit (GRU) to process time series data. The GRU outputs a hidden state at each time step, which contains the sequence information up to the current time. Then, the GRU hidden state of the temporal dependence analysis layer and the attention weights are jointly optimized, that is, the parameters of the GRU and the parameters in the attention mechanism are adjusted simultaneously, so that the GRU hidden state can better capture the information related to the important features emphasized by the attention weights and can better reflect the temporal dependence relationship between features. For example, when the attention weights highlight a specific semantic feature, the GRU hidden state can also encode and remember this feature more effectively accordingly; by jointly optimizing to construct a feature embedding space immune to adversarial perturbations, it can better preserve the semantic and temporal information of the features and has stronger immunity to some malicious adversarial perturbations (such as minor modifications or adding noise to the feature data), so that the model can still accurately identify and classify features when facing these perturbations. Among them, the feature embedding space maps the features into a low-dimensional vector space, in which similar features are close and different features are separated.

[0047] Preferably, in the constructed feature embedding space, features can be regarded as composed of multiple channels (similar to the RGB channels in images). By calculating the mutual information gradient between feature channels, that is, calculating the rate and direction of information change between different feature channels, it is possible to understand which channels have more frequent and important information interactions and how information flows between channels. For example, if the mutual information gradient of a certain feature channel is large, it indicates that it has close information exchange with other channels and makes a greater contribution to the overall feature representation; the resistant sample filtering layer will evaluate the confidence of the input samples and give a confidence score, reflecting the possibility that the sample is a normal sample or an abnormal sample; then, the mutual information gradient between feature channels and the confidence score of the resistant sample filtering layer are combined, comprehensively considering the importance of information interaction of the features themselves and the overall abnormality possibility of the samples, and finally a non-linear feature importance mask is generated, that is, a vector corresponding to the feature dimension, where the value of each element represents the importance degree of that feature dimension. In a non-linear way (such as using activation functions, etc.), the value of each element in the mask is determined according to the mutual information gradient and the confidence score, which is used to screen and emphasize the features that are more important for the final cascaded recognition result, helping the model make more accurate judgments, such as identifying abnormal SMS behaviors.

[0048] Further, step S200 further includes step S240 of constructing a generative adversarial network, which is used to simulate the feature distribution of an attacker forging normal samples; and step S250 of identifying potential adversarial samples through the confidence difference output by the discriminator, and suppressing the gradient propagation of the potential adversarial samples by using the feature reconstruction error and the gradient masking strategy.

[0049] Preferably, constructing a generative adversarial network includes a generator and a discriminator. The generator is used to generate forged samples similar to real samples, while the discriminator is used to distinguish real samples from the forged samples generated by the generator. The generative adversarial network is used to simulate the feature distribution of an attacker forging normal samples. Specifically, the generator is used to simulate an attacker forging normal samples. An attacker may try to bypass the anomaly detection system by making some modifications or forgeries to normal samples to make them look like normal SMS behavior samples. The generator learns the feature distribution of real normal samples (such as samples composed of spatio-temporal distribution features, semantic association graphs, and device behavior fingerprints of normal SMS interactions), generates forged samples as realistic as possible. The forged samples have similar feature patterns to real normal samples but are actually created by the generator. By continuously training the generator, it can accurately simulate the forging methods that an attacker may adopt, so as to better understand potential attack means and the generation mechanism of abnormal samples.

[0050] Preferably, after receiving samples (including real samples and forged samples generated by the generator), the discriminator evaluates the samples and outputs a confidence score indicating the likelihood that the sample is a real sample. For real normal samples, the discriminator should output a relatively high confidence score; while for forged samples (i.e., potential adversarial samples), the confidence score of the discriminator should be relatively low. By comparing the differences in the confidence scores output by the discriminator for different samples, potential adversarial samples that may be forged by attackers are identified. For example, if the confidence score of a sample is significantly lower than that of other normal samples, it may be a potential adversarial sample. Then, its authenticity is further verified by calculating its feature reconstruction error. Among them, the feature reconstruction error refers to the difference between the features of the sample after reconstruction (such as through methods like autoencoders) and the original sample features. If the sample is normal, its features should be able to be reconstructed relatively accurately, and the reconstruction error is small; while for adversarial samples, since their features may be tampered with or forged by attackers, the reconstruction error may be large. By setting a reconstruction error threshold, real adversarial samples are further screened out. Then, a gradient masking strategy is adopted to prevent adversarial samples from having an adverse impact on model parameter updates (such as misleading the model to learn incorrect feature patterns). Among them, gradient masking refers to suppressing or masking the gradients of potential adversarial samples when calculating gradients. Specifically, according to the confidence score or reconstruction error of the sample, a gradient masking value is assigned to each sample. If a sample is considered a potential adversarial sample, its gradient masking value can be set to a relatively low value, thereby reducing the impact of the sample on the model during parameter updates, enabling the model to more robustly learn the feature patterns of real samples, and improving the model's detection ability for abnormal samples and its defense ability against adversarial attacks.

[0051] Furthermore, step S250 further includes inserting a gradient reversal layer after the last convolutional layer of the discriminator to dynamically adjust the gradient direction and force the adversarial samples to form a gradient flat area in the latent space.

[0052] Preferably, a gradient reversal layer is inserted after the last convolutional layer of the discriminator. Among them, the gradient reversal layer is a special neural network layer that operates on the gradients during model training. During forward propagation, it does not change the transmission of data, that is, the data can pass through this layer for forward calculation normally. However, during backward propagation, it reverses the direction of the gradient, that is, multiplies the original gradient by -1. When calculating the gradients of adversarial samples, due to the effect of the gradient reversal layer, the gradient direction of adversarial samples will be dynamically adjusted. Compared with the gradient direction of normal samples, the gradients of adversarial samples will propagate in the opposite direction, facilitating the discriminator to process adversarial samples and normal samples differently, enabling the discriminator to better distinguish these two types of samples.

[0053] Preferably, through gradient reversal, the way of gradient propagation of adversarial samples in the latent space is changed. Normally, the model updates its parameters through gradient descent, making the model optimize in the direction of reducing the loss function. For adversarial samples, after gradient reversal, their gradients will guide the model parameters to develop in the direction of making the features of adversarial samples become more "blurred" or "flat" in the latent space, indicating that the representation of adversarial samples in the latent space will gradually become indistinguishable, forming a gradient flat region. At this time, the features of adversarial samples will not have too much impact on the parameter update of the model, thereby reducing the interference of adversarial samples to the model, improving the robustness of the model and the classification accuracy of normal samples; at the same time, it helps the model better learn the features of normal samples to more accurately identify abnormal behaviors.

[0054] Step S300, according to the cascaded recognition result, dynamically adjust the feature fusion weight matrix to generate an abnormal probability score. When the abnormal probability score exceeds the dynamic abnormal probability threshold, trigger a multi-stage verification mechanism.

[0055] Preferably, according to the cascaded recognition result, dynamically adjust the feature fusion weight matrix. Specifically, if it is found that certain features play a key role in accurately identifying abnormal behaviors, the weight values of these features in the weight matrix are correspondingly increased; conversely, if the contribution of certain features to the recognition result is small or even may lead to misjudgment, their weight values are reduced; thereby making the feature fusion more reasonable, being able to better highlight the information valuable for anomaly detection, and improving the accuracy and adaptability of detection. For example, in a certain cascaded recognition, it is found that the semantic association graph feature is very crucial for identifying the abnormal behavior of fraudulent text messages, then increase the corresponding weight of the semantic association graph feature in the weight matrix; then fuse the collected multi-dimensional features (such as the spatio-temporal distribution features of text message interactions, semantic association graphs, device behavior fingerprints, etc.) according to the adjusted weight matrix to obtain a feature vector, and calculate to obtain the probability value indicating that this sample is an abnormal sample, that is, the abnormal probability score, which reflects the likelihood that this sample belongs to an abnormal behavior according to the current feature fusion and model judgment. For example, an abnormal probability score of 0.8 means that this sample has an 80% probability of being an abnormal sample. Set the dynamic abnormal probability threshold according to the distribution characteristics of the data and the requirements of detection, etc. Specifically, in different time periods (such as peak and off-peak business periods), since the normal patterns of text message behaviors may be different, the abnormal probability threshold is adjusted accordingly, or according to the statistical analysis of historical detection data, when it is found that the false alarm rate or miss rate is too high, the threshold is adjusted; when the calculated abnormal probability score exceeds the current dynamic abnormal probability threshold, it indicates that this sample is very likely to be an abnormal sample, and then trigger a multi-stage verification mechanism for confirmation to more accurately judge whether the sample really belongs to an abnormal behavior, reduce false alarms and missed detections, and improve the reliability of anomaly detection.

[0056] Further, step S300 further includes step S310 of determining a threshold baseline value according to the time decay factor of historical abnormal events; and step S320 of introducing a dynamic offset coefficient based on the threshold baseline value, combining the current network environment risk level and the user identity credibility, and smoothly updating the dynamic abnormal probability threshold.

[0057] Preferably, relevant data of historical abnormal events are obtained from historical records, including the occurrence time, event type, impact degree, etc., and the event decay factor of historical abnormal events is determined. Among them, the time decay factor is usually a value between 0 and 1, which is used to measure the change of the influence degree of historical abnormal events on the current threshold determination over time. Generally speaking, the more recent abnormal events have a greater impact on the current situation, and as time goes by, the influence of past abnormal events will gradually weaken. For example, assuming that the time decay factor is 0.9, every time a unit of time passes from now, the influence of historical abnormal events will be multiplied by 0.9 and gradually become smaller. Then, the weighted sum of historical abnormal events is calculated according to the time decay factor to determine the threshold baseline value. For example, the severity of abnormal events occurring at different time points in the past is multiplied by the corresponding time decay factor and then added up to obtain a comprehensive value, which is used as the threshold baseline value.

[0058] Preferably, the security and stability of the network environment change at any time. The risk level is evaluated according to various risk factors existing in the current network (such as network attack frequency, number of vulnerabilities, network traffic anomalies, etc.). Among them, the risk level can be represented by different levels, such as low, medium, and high. For example, when a large number of malicious attack attempts occur in the network, the network environment risk level is rated as high; according to the user's historical behavior records, the strength of the identity authentication method, whether there are abnormal login behaviors, etc., the credibility of the user identity is evaluated to obtain the user identity credibility, and the value range may be from 0 to 1. The higher the value, the higher the credibility. For example, a user who has logged in through a strong identity authentication method for a long time and stably without abnormal behavior records has a high identity credibility. Then, the dynamic offset coefficient is determined according to the current network environment risk level and the user identity credibility. Generally speaking, the higher the network environment risk level, the greater the dynamic offset coefficient, so that the threshold is adjusted in a lower direction to more sensitively detect abnormalities; and the higher the user identity credibility, the smaller the dynamic offset coefficient, and the threshold will be relatively stable or adjusted in a higher direction to avoid misjudging the normal behavior of trusted users as abnormal.

[0059] Preferably, the dynamic offset coefficient is combined with the threshold baseline value, and the dynamic anomaly probability threshold is updated through a certain calculation method (such as multiplication or addition, etc.). Specifically, to avoid drastic changes in the threshold, a smooth update method is usually adopted, that is, the update amplitude each time is not too large, so that the threshold can be gradually adjusted with the changes of the network environment and user conditions, maintaining the accuracy and stability of detection. For example, assuming the threshold baseline value is 0.6 and the dynamic offset coefficient is 0.8, and the multiplication method is used for update, the updated dynamic anomaly probability threshold is 0.6×0.8 = 0.48. However, in actual operation, it may not be directly updated to 0.48, but gradually approaches 0.48 according to the smooth update strategy, such as updating by 0.05 each time, and reaching a value close to 0.48 after multiple updates.

[0060] Step S400, with the multi-stage verification mechanism, match the time series pattern in the user's historical behavior baseline at the edge computing node, dynamically generate the verification code trigger threshold, and perform interactive risk verification in combination with the context scene features to determine the abnormal SMS behavior mark.

[0061] Preferably, the multi-stage verification mechanism is used to improve the verification accuracy and security. It usually includes multiple verification steps or stages that are carried out in sequence, and the results of the previous stage will affect the execution of the subsequent stage. Through step-by-step in-depth verification, the authenticity of relevant behaviors or events can be more comprehensively evaluated and judged. Specifically, at the edge computing node, match the time series pattern in the user's historical behavior baseline to find out whether the user's behavior conforms to the previous pattern. If there is a large deviation between the current behavior and the historical time series pattern, it may indicate an abnormal situation. Among them, the edge computing node is a computing node close to the data source or the user side, which can perform data processing and analysis locally, reducing data transmission delay and dependence on the cloud. The user's historical behavior baseline includes various behavior characteristics of the user within a period of time, such as operation time, operation frequency, operation type, etc. The time series pattern refers to the pattern presented by the user's behavior in the time series. For example, the user usually sends SMS at a specific time period every day, or performs a certain specific operation at regular time intervals. Then, according to the time series pattern in the user's historical behavior baseline and other relevant factors (such as the current network environment, recent security events, etc.), generate the verification code trigger threshold. For example, if the user's behavior is basically consistent with the historical time series pattern and the current network environment is secure, the verification code trigger threshold may be relatively high, that is, it is not easy to trigger the verification code verification; but if there are some abnormal signs in the user's behavior, such as the operation time deviates significantly from the normal, or there is a security risk in the recent network environment, the verification code trigger threshold will be lowered to further confirm the user's identity and the legality of the behavior through the verification code verification in a timely manner.

[0062] Preferably, by combining user behavior information (such as whether it conforms to the timing pattern, whether a verification code is triggered, etc.) with context scenario features, interactive verification and risk assessment are carried out. Among them, the context scenario features include various background information related to the current behavior, such as the content of the short message, the recipient, the geographical location, device information, etc. For example, if a user sends a short message at an atypical time, the content of the short message contains sensitive information, and the recipient is an uncommon number, a comprehensive analysis is carried out to judge the risk level of this behavior, which may include requiring the user to perform additional verification operations, such as answering some questions related to the context scenario, or confirming the user's identity through other interactive methods to verify whether there is an abnormal risk. After multi-stage verification, matching, dynamic threshold judgment, and interactive risk verification, it is determined whether to mark the current short message behavior as abnormal according to the final evaluation result. If the comprehensive analysis finds that the behavior has a high risk, does not conform to the user's historical behavior pattern, and the context scenario features are also abnormal, the short message behavior is marked as an abnormal short message behavior to ensure the security of the system and the interests of users.

[0063] Further, step S400 further includes step S410 of deploying edge computing nodes based on the central computing node, performing distributed feature preprocessing on the dynamic feature pool, and dynamically offloading computing tasks according to the device resource status; step S420 of configuring a lightweight detection sub-process through the offloaded computing tasks; and step S430 of using the lightweight detection sub-process to establish a local caching mechanism on the edge computing node, where the local caching mechanism is used to perform local interception operations.

[0064] Preferably, deploying edge computing nodes based on the central computing node means taking the central computing node as the core and setting multiple edge computing nodes at the network edge close to the data source or the user. Thus, some computing tasks can be sunk from the central computing node to the edge computing nodes, reducing data transmission latency and improving the response speed and processing efficiency of the system. Then, the data in the dynamic feature pool is preprocessed by multiple edge computing nodes. Each edge computing node is responsible for processing a part of the feature data. By performing operations such as cleaning, screening, and extracting key features on the data locally, the original and complex feature data is transformed to reduce the computing burden on the central computing node. At the same time, the local processing capabilities of the edge computing nodes can also be utilized to preliminarily process the feature data faster. Each edge computing node has its own device resource limitations, such as computing power, memory, storage, etc. According to the real-time status of the device resources, it is dynamically determined whether to offload some computing tasks from the current edge computing node to other nodes or the central computing node. For example, when the CPU usage rate of a certain edge computing node is too high or the memory is insufficient, some non-urgent computing tasks are transferred to other nodes for execution to ensure the timely processing of computing tasks.

[0065] Preferably, during the process of offloading computing tasks, the detection process is optimized and adjusted according to the actual situation to form a lightweight detection sub-process, so as to meet the requirements of edge computing nodes under resource-constrained conditions, while ensuring the detection and processing capabilities of key information and not affecting the recognition and response to abnormal situations. Then, using the configured lightweight detection sub-process, a local caching mechanism is established on the edge computing node to temporarily store some frequently accessed (such as feature data, model parameters, historical detection results, etc.) or processed data locally, so that it can be quickly obtained when needed next time, reducing the number of accesses to remote data storage or the central computing node. When a new detection task arrives, first search for relevant information in the local cache. If it exists, it can be directly used without having to obtain it from the remote again or recalculate, thereby improving the response speed and saving computing resources. The local caching mechanism is also used to perform local interception operations. Specifically, when the edge computing node receives data or requests, it first checks and judges through the local caching mechanism. If certain data or requests meet specific interception conditions, such as matching known abnormal features or blacklist information in the cache, the edge computing node can directly intercept and process them locally, quickly blocking potential dangerous or abnormal data, improving security and processing efficiency.

[0066] Further, step S430 further includes step S431 of establishing a behavior query index using LSH (Locality-Sensitive Hashing); step S432 of determining context scenario features based on the behavior query index, where the context scenario features include GPS trajectory clustering labels and application process CPU occupancy rate fluctuations; step S433 of dynamically adjusting the similarity fluctuation range according to the context scenario features and in combination with historical behavior baseline data. If the similarity score does not meet the similarity threshold under the similarity fluctuation range, the local interception operation is triggered.

[0067] Preferably, the LSH (Locality-Sensitive Hashing) is used to establish a behavior query index. Among them, the LSH can map similar data to adjacent hash buckets. When processing behavior data, it can map the SMS interaction behavior data to the same or similar hash values according to the feature similarity. Specifically, the behavior data of the user or device is processed by the LSH, and hash mapping is performed according to the similarity of features such as SMS sending time, sending frequency, and receiving object, so as to construct a behavior query index. When it is necessary to query other behaviors similar to a specific behavior, the behavior query index can quickly locate the set of behavior data that may be similar, greatly improving the query efficiency; then analyze the data of the behavior query index to determine the context scenario features, specifically including GPS trajectory clustering labels and the CPU occupancy rate fluctuation of the application process. Among them, the GPS trajectory data corresponding to the relevant behavior is found through the behavior query index, and the GPS trajectory data of the device is subjected to clustering analysis, and the similar trajectories are divided into the same category, and each category is assigned a label to obtain the GPS trajectory clustering label to reflect the movement mode of the device in different time periods or different regions; monitor the CPU occupancy rate of the application process running on the device, and analyze its fluctuation changes before and after the behavior occurs. Different behaviors may lead to different CPU occupancy rate fluctuation patterns of the application process. For example, sending a large number of SMS may cause the CPU occupancy rate of the SMS application process to increase, while some malicious software behaviors may cause abnormal CPU occupancy rate fluctuations.

[0068] Preferably, the context scenario features are compared and analyzed with the historical behavior baseline data. According to the differences between the two and other relevant factors (such as time changes, environmental changes, etc.), the similarity fluctuation range is dynamically adjusted. The similarity fluctuation range represents the acceptable range of similarity between the current behavior and the historical normal behavior. For example, if the current environment is relatively stable and the user behavior pattern changes little, the similarity fluctuation range may be relatively narrow; while if there are significant changes in the current environment or some new situations occur in the user behavior, the similarity fluctuation range may be appropriately widened. The similarity between the context scenario features of the current behavior and the historical behavior baseline data is calculated through cosine similarity, Euclidean distance, etc. to obtain a similarity score, which reflects the similarity degree between the current behavior and the historical normal behavior; then it is compared with the similarity threshold under the similarity fluctuation range. Among them, the similarity threshold is used to determine whether the similarity score is within the acceptable range. Specifically, if the calculated similarity score does not meet the similarity threshold under the similarity fluctuation range, that is, the similarity between the current behavior and the historical normal behavior exceeds the acceptable range, it indicates that the current behavior may be abnormal. At this time, the edge computing node triggers a local interception operation to prevent the behavior from continuing, so as to prevent possible security risks or abnormal situations. That is, when it is detected that the similarity score between the context scenario features of the SMS sending behavior and the historical behavior baseline data is too low and does not meet the set similarity threshold, the sending operation of this SMS is intercepted.

[0069] In the above, reference is made to Figure 1 The method for detecting abnormal SMS behaviors based on multi-dimensional feature fusion according to the embodiments of the present invention is described in detail. Next, reference will be made to Figure 2 Describe the system for detecting abnormal SMS behaviors based on multi-dimensional feature fusion according to the embodiments of the present invention.

[0070] The system for detecting abnormal SMS behaviors based on multi-dimensional feature fusion according to the embodiments of the present invention is used to solve the technical problems existing in the prior art, such as single detection dimension, difficulty in identifying new and complex abnormal SMS behaviors, resulting in insufficient detection timeliness and adaptability and high false alarm and missed alarm rates, and achieves the technical effects of reducing the false alarm and missed alarm rates of SMS anomaly detection, and improving the detection timeliness and adaptability. As Figure 2 shown, the system for detecting abnormal SMS behaviors based on multi-dimensional feature fusion includes: a cross-modal feature sequence extraction module 10, a cascaded recognition module 20, an abnormal probability score generation module 30, and an abnormal SMS behavior marking determination module 40.

[0071] The cross-modal feature sequence extraction module 10 is used to collect the spatio-temporal distribution features, semantic association graph, and device behavior fingerprints of the SMS interaction, configure a dynamic feature pool, extract cross-modal feature sequences through a sliding time window, and determine the mutual information entropy and abnormal deviation degree between each feature dimension; the cascaded recognition module 20 is used to upload the mutual information entropy and abnormal deviation degree between each feature dimension to the central computing node for cascaded recognition, and the central computing node includes a feature selection layer, a temporal dependence analysis layer, and an adversarial sample filtering layer based on the attention mechanism; the abnormal probability score generation module 30 is used to dynamically adjust the feature fusion weight matrix according to the cascaded recognition result and generate an abnormal probability score. When the abnormal probability score exceeds the dynamic abnormal probability threshold, a multi-stage verification mechanism is triggered; the abnormal SMS behavior marking determination module 40 is used to match the temporal pattern in the user's historical behavior baseline at the edge computing node with the multi-stage verification mechanism, dynamically generate a verification code trigger threshold, and perform interactive risk verification in combination with the context scene features to determine the abnormal SMS behavior marking.

[0072] Next, the specific configuration of the cross-modal feature sequence extraction module 10 will be described in detail. The cross-modal feature sequence extraction module 10 further includes: parsing the syntactic dependency tree of the SMS text to extract the semantic conflict index; capturing the high-frequency operation behaviors in the device operation sequence based on the semantic conflict index to generate a behavior pattern coding vector; fusing the base station positioning trajectory and the IP address jump feature according to the behavior pattern coding vector to construct a spatio-temporal anomaly topology graph; performing tensor splicing on the behavior pattern coding vector and the spatio-temporal anomaly topology graph to configure the dynamic feature pool.

[0073] Next, the specific configuration of the cross-modal feature sequence extraction module 10 will continue to be described in detail. The cross-modal feature sequence extraction module 10 further includes: using the asymmetric KL divergence to quantify the distribution difference between the semantic association graph and the device behavior fingerprint, and performing quantile mutation detection on the feature values within the sliding time window to configure the local outlier factor of the spatio-temporal distribution feature; based on the local outlier factor of the spatio-temporal distribution feature, mapping the temporal features to a two-dimensional matrix through the Gram angular field transformation to extract the spatial correlation features, and the spatial correlation features are used to dynamically correct the edge weights of the spatio-temporal anomaly topology graph.

[0074] Next, the specific configuration of the cascaded recognition module 20 will be described in detail. The cascaded recognition module 20 further includes: using a multi-head self-attention mechanism to assign weights to the cross-modal feature sequence, and introducing a differentiable feature gating unit to filter redundant dimensions according to the feature contribution degree to obtain the initially screened selected features; based on the initially screened selected features, jointly optimizing the GRU hidden state of the temporal dependence analysis layer and the attention weights to construct a feature embedding space immune to adversarial perturbations; in the feature embedding space, determining the mutual information gradient between feature channels, and combining the confidence score of the resistance sample filtering layer to generate the non-linear feature importance mask in the cascaded recognition result.

[0075] Next, the specific configuration of the cascaded recognition module 20 will be further described in detail. The cascaded recognition module 20 further includes: constructing a generative adversarial network, which is used to simulate the attacker to forge the feature distribution of normal samples; identifying potential adversarial samples through the confidence difference output by the discriminator, and adopting a feature reconstruction error and gradient mask strategy to suppress the gradient propagation of the potential adversarial samples.

[0076] Next, the specific configuration of the cascaded recognition module 20 will be further described in detail. The cascaded recognition module 20 further includes: inserting a gradient reversal layer after the last convolutional layer of the discriminator to dynamically adjust the gradient direction and force the adversarial samples to form a gradient flat area in the latent space.

[0077] Next, the specific configuration of the abnormal probability score generation module 30 will be described in detail. The abnormal probability score generation module 30 further includes: determining the threshold baseline value according to the time decay factor of historical abnormal events; based on the threshold baseline value, combining the current network environment risk level and user identity credibility, introducing a dynamic offset coefficient, and smoothly updating the dynamic abnormal probability threshold.

[0078] Next, the specific configuration of the abnormal SMS behavior marking determination module 40 will be described in detail. The abnormal SMS behavior marking determination module 40 further includes: deploying edge computing nodes based on the central computing node to perform distributed feature preprocessing on the dynamic feature pool, and dynamically offloading computing tasks according to the device resource status; configuring a lightweight detection sub-process through the offloaded computing tasks; using the lightweight detection sub-process to establish a local caching mechanism at the edge computing node, and the local caching mechanism is used to perform local interception operations.

[0079] Next, the specific configuration of the abnormal SMS behavior marking determination module 40 will be further described in detail. The abnormal SMS behavior marking determination module 40 further includes: establishing a behavior query index by using LSH locality-sensitive hashing; determining context scenario features based on the behavior query index, where the context scenario features include GPS trajectory clustering labels and application process CPU occupancy rate fluctuations; dynamically adjusting the similarity fluctuation range according to the context scenario features and in combination with historical behavior baseline data, and triggering the local interception operation if the similarity score does not meet the similarity threshold under the similarity fluctuation range.

[0080] The abnormal SMS behavior detection system based on multi-dimensional feature fusion provided by the embodiments of the present invention can execute the abnormal SMS behavior detection method based on multi-dimensional feature fusion provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the method.

[0081] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, however, any number of different modules can be used and run on the user terminal and / or the server. The included individual units and modules are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be realized; in addition, the specific names of the functional units are only for the convenience of mutual distinction and do not limit the protection scope of the present invention.

[0082] The above specific implementation manners do not constitute a limitation to the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present application shall be included within the protection scope of the present application.

Claims

1. The abnormal SMS behavior detection method based on multi-dimensional feature fusion is characterized by: include: Collect the spatiotemporal distribution characteristics, semantic association graphs and device behavior fingerprints of SMS interactions, configure a dynamic feature pool, extract cross-modal feature sequences through a sliding time window, and determine the mutual information entropy and abnormal deviation between each feature dimension; Uploading the mutual information entropy and abnormal deviation between the feature dimensions to the central computing node for cascade recognition, wherein the central computing node includes a feature selection layer based on the attention mechanism, a temporal dependency analysis layer, and an adversarial sample filtering layer; According to the cascade recognition results, the feature fusion weight matrix is ​​dynamically adjusted to generate an abnormality probability score. When the abnormality probability score exceeds the dynamic abnormality probability threshold, a multi-stage verification mechanism is triggered; With the multi-stage verification mechanism, the time series pattern in the user's historical behavior baseline is matched at the edge computing node, the verification code trigger threshold is dynamically generated, and interactive risk verification is performed in combination with contextual scenario features to determine abnormal SMS behavior markers.

2. The abnormal SMS behavior detection method based on multi-dimensional feature fusion as claimed in claim 1 is characterized in that: Collect the spatiotemporal distribution characteristics, semantic association graphs, and device behavior fingerprints of SMS interactions, and configure a dynamic feature pool, including: Parse the syntactic dependency tree of SMS text and extract the semantic conflict index; Based on the semantic conflict index, high-frequency operation behaviors in the device operation sequence are captured to generate a behavior pattern encoding vector; According to the behavior pattern encoding vector, the base station positioning trajectory and the IP address jump characteristics are integrated to construct a spatiotemporal anomaly topology map; The behavior pattern encoding vector and the spatiotemporal anomaly topology map are tensor-joined to configure the dynamic feature pool.

3. The abnormal SMS behavior detection method based on multi-dimensional feature fusion as claimed in claim 2 is characterized in that: Before tensor splicing of the behavior pattern encoding vector and the spatiotemporal anomaly topology map, the method further includes: Asymmetric KL divergence is used to quantify the distribution difference between the semantic association graph and the device behavior fingerprint, and quantile mutation detection of feature values ​​in a sliding time window is performed to configure the local outlier factor of the spatiotemporal distribution feature; Based on the local outlier factor of the spatiotemporal distribution characteristics, the time series characteristics are mapped into a two-dimensional matrix through Gram angular field transformation, and the spatial correlation characteristics are extracted. The spatial correlation characteristics are used to dynamically correct the edge weights of the spatiotemporal anomaly topology graph.

4. The abnormal SMS behavior detection method based on multi-dimensional feature fusion according to claim 1 is characterized in that: The central computing node includes a feature selection layer based on the attention mechanism, a temporal dependency analysis layer, and an adversarial sample filtering layer, including: A multi-head self-attention mechanism is used to assign weights to the cross-modal feature sequence, and a differentiable feature gating unit is introduced to filter redundant dimensions according to feature contribution to obtain initial screening features; Based on the initially selected features, the GRU hidden state and attention weight of the temporal dependency analysis layer are jointly optimized to construct a feature embedding space that is immune to disturbances; In the feature embedding space, the mutual information gradient between feature channels is determined, and combined with the confidence score of the resistant sample filter layer, a nonlinear feature importance mask in the cascade recognition result is generated.

5. The abnormal SMS behavior detection method based on multi-dimensional feature fusion as claimed in claim 4 is characterized in that: Constructing a generative adversarial network, wherein the generative adversarial network is used to simulate the feature distribution of a normal sample forged by an attacker; Potential adversarial samples are identified through the confidence difference of the discriminator output, and the feature reconstruction error and gradient mask strategy are used to suppress the gradient propagation of the potential adversarial samples.

6. The abnormal SMS behavior detection method based on multi-dimensional feature fusion as claimed in claim 5 is characterized in that: The feature reconstruction error and gradient masking strategy are used to suppress the gradient propagation of the potential adversarial sample, and further includes: A gradient reversal layer is inserted after the last convolutional layer of the discriminator to dynamically adjust the gradient direction and force the adversarial sample to form a gradient flat area in the latent space.

7. The abnormal SMS behavior detection method based on multi-dimensional feature fusion according to claim 1 is characterized in that: When the anomaly probability score exceeds the dynamic anomaly probability threshold, a multi-stage verification mechanism is triggered, which also includes: Determine the threshold baseline value based on the time decay factor of historical abnormal events; Based on the threshold baseline value, combined with the current network environment risk level and user identity credibility, a dynamic offset coefficient is introduced, and the dynamic abnormal probability threshold is smoothly updated.

8. The abnormal SMS behavior detection method based on multi-dimensional feature fusion as claimed in claim 1, characterized in that: Interactive risk verification based on contextual scenario features also includes: Based on the central computing node, edge computing nodes are deployed to perform distributed feature preprocessing on the dynamic feature pool and dynamically unload computing tasks according to device resource status; By offloading the computing tasks, a lightweight detection sub-process is configured; Using the lightweight detection sub-process, a local cache mechanism is established at the edge computing node, and the local cache mechanism is used to perform local interception operations.

9. The abnormal SMS behavior detection method based on multi-dimensional feature fusion as claimed in claim 8, characterized in that: The local cache mechanism is used to perform local interception operations, including: Use LSH local sensitive hashing to build a behavior query index; Based on the behavior query index, determining context scene features, the context scene features including GPS track clustering labels and application process CPU occupancy rate fluctuations; According to the context scene features and in combination with the historical behavior baseline data, the similarity fluctuation range is dynamically adjusted, and if the similarity score does not meet the similarity threshold under the similarity fluctuation range, the local interception operation is triggered.

10. Abnormal SMS behavior detection system based on multi-dimensional feature fusion, characterized by: The system is used to implement the abnormal SMS behavior detection method based on multi-dimensional feature fusion according to any one of claims 1 to 9, and the system includes: The cross-modal feature sequence extraction module is used to collect the spatiotemporal distribution characteristics, semantic association graphs and device behavior fingerprints of SMS interactions, configure a dynamic feature pool, and extract cross-modal feature sequences through a sliding time window to determine the mutual information entropy and abnormal deviation between each feature dimension; A cascade recognition module, which is used to upload the mutual information entropy and abnormal deviation between the feature dimensions to the central computing node for cascade recognition. The central computing node includes a feature selection layer based on the attention mechanism, a temporal dependency analysis layer, and an adversarial sample filtering layer; An abnormal probability score generation module is used to dynamically adjust the feature fusion weight matrix according to the cascade recognition results to generate an abnormal probability score. When the abnormal probability score exceeds the dynamic abnormal probability threshold, a multi-stage verification mechanism is triggered; The abnormal SMS behavior mark determination module is used to match the timing pattern in the user's historical behavior baseline at the edge computing node with the multi-stage verification mechanism, dynamically generate the verification code trigger threshold, and perform interactive risk verification in combination with contextual scenario features to determine the abnormal SMS behavior mark.

Images