Communication risk identification method and system based on multi-modal behavior fusion

Abstract

The invention provides a communication risk identification method and system based on multi-modal behavior fusion, and relates to the field of communication risk identification, and the method comprises the steps: fusing a network environment vector, an authority feature vector, a multimedia vector and a social behavior vector of a target terminal in a communication process within a preset time period, and obtaining a multi-dimensional feature vector; inputting the multi-dimensional feature vector to a preset causal graph model to obtain a fusion vector; inputting the fusion vector to a TCN-Transform hybrid model to obtain a target risk probability value; and generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold. The method can dynamically adapt to archive security level changes and semantic association scenes, and the real-time performance and accuracy of prediction are improved. According to the method, the behavior characteristics of the target terminal in the communication process can be reflected more comprehensively, so that the potential communication risk can be identified more accurately, real-time monitoring and early warning of the communication risk are realized, the false alarm rate and the missing report rate are effectively reduced, and the reliability of risk identification is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication risk identification, and particularly to a communication risk identification method and system based on multi-modal behavior fusion. Background Art

[0002] In the current digital communication environment, communication security has become a crucial issue. With the rapid development of communication technologies and the popularization of smart terminals, various communication methods, such as text messages, phone calls, social media, and instant messaging applications, have become an indispensable part of people's daily lives. However, this has also provided opportunities for lawbreakers to carry out illegal activities such as fraud and deception using communication means. Therefore, how to effectively identify and defend against potential risks in the communication process has become an urgent technical problem to be solved.

[0003] Traditional communication risk identification methods mainly rely on single detection means, such as keyword-based text message filtering, behavior pattern-based phone call interception, etc. However, these methods often have problems such as low detection accuracy, high false alarm rate, and poor adaptability. For example, the keyword-based text message filtering method can intercept some text messages containing sensitive keywords, but it is easily attacked by bypass means such as keyword deformation and synonym replacement. At the same time, due to the diversity of text message content, it is difficult to construct a comprehensive and accurate keyword library. In addition, traditional communication risk identification methods also lack comprehensive consideration of user behavior characteristics. In actual situations, communication risks are often closely related to multiple factors such as user behavior patterns, network environments, and social relationships. For example, a user sending a large number of text messages containing sensitive information in a short period of time, or frequently making calls with unfamiliar numbers, may indicate the existence of communication risks. However, traditional detection methods often ignore these behavior characteristics, resulting in poor detection effects.

[0004] To solve the above problems, in recent years, communication risk identification methods based on machine learning and artificial intelligence technologies have gradually received attention. These methods can automatically extract features related to communication risks and construct corresponding risk identification models through the analysis and learning of a large amount of communication data. However, existing communication risk identification methods based on machine learning still have some deficiencies. For example, some methods only consider single communication features, such as text message content, call duration, etc., while ignoring other important behavior features. In addition, some methods may face problems such as poor model generalization ability and low computational efficiency when dealing with complex and variable communication data. And currently, there is no technical solution that can solve the above technical problems, and there is no communication risk identification method and system based on multi-modal behavior fusion. Summary of the Invention

[0005] The present invention provides a communication risk identification method and system based on multi-modal behavior fusion, which can solve the technical problems of low accuracy, poor adaptability and high false alarm rate existing in the existing communication risk identification methods.

[0006] In a first aspect, the present invention provides a communication risk identification method based on multi-modal behavior fusion, including:

[0007] Fusing the network environment vector, permission feature vector, multimedia vector and social behavior vector of the target terminal during the communication process within a preset time period to obtain a multi-dimensional feature vector, where the network environment vector is determined according to the WiFi type, VPN status and abnormal port detection event frequency, the permission feature vector is determined according to the APP permission deviation index and sensitive permission combination risk index, the multimedia vector is determined according to the picture risk index and voiceprint risk index, and the social behavior vector is determined according to the social circle mutation rate and emergency induction keyword density;

[0008] Inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model;

[0009] Inputting the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model;

[0010] Generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, where the target defense instruction is used to instruct the target terminal to activate a target defense strategy.

[0011] According to the communication risk identification method based on multi-modal behavior fusion provided by the present invention, before fusing the network environment vector, permission feature vector, multimedia vector and social behavior vector of the target terminal during the communication process within a preset time period to obtain a multi-dimensional feature vector, the method further includes:

[0012] Using One-Hot encoding to distinguish the home network, enterprise internal network and public hot spot in the WiFi type, parsing the VPN identification bit in the VPN status through the TCP / IP protocol stack, statistically counting the abnormal port detection event frequency based on a preset sliding time window, and compressing it to the [0,1] interval through logarithmic transformation to determine the network environment vector;

[0013] For any APP in the target terminal, count the application frequencies of the common permissions of the similar APPs corresponding to the APP, construct the benchmark probability distribution of each common permission, determine the actual probability distribution of each common permission according to the actual permission application list of the APP, calculate the benchmark probability distribution and the actual probability distribution based on a preset JS divergence, determine the JS divergence of the common permission, traverse each common permission in all APPs, determine the JS divergence of each common permission, determine the APP permission deviation index according to all JS divergences, where the common permission is the permission shared by the APP and the similar APPs; input all the enabled permissions in the APP into a preset sensitive permission combination detection model to obtain the sensitive permission combination risk output by the preset sensitive permission combination detection model, traverse all APPs, and determine the sensitive permission combination risk index according to all sensitive permission combination risks; fuse the APP permission deviation index and the sensitive permission combination risk index to obtain a permission feature vector;

[0014] Extract all the pictures received within the preset time period. For each picture, input the picture into a preset picture risk model to obtain the picture risk degree output by the preset picture risk model. Traverse all the pictures and determine the picture risk index according to each picture risk degree corresponding to all the pictures; extract all the voiceprint information received within the preset time period. For each voiceprint information, extract the voiceprint MFCC features, match the voiceprint MFCC features with the fraud voice features in a preset fraud voice database to obtain the voiceprint similarity. Traverse all the voiceprint information and determine the voiceprint risk index according to all the voiceprint similarities. Determine the multimedia vector according to the picture risk index and the voiceprint risk index;

[0015] Determine the social circle mutation rate according to the number of newly added contacts of the target terminal within the preset time period and the historical average number of newly added contacts. Obtain the conversation records of each APP of the target terminal within the preset time period. For each conversation record, determine the keyword density of the conversation record according to the target keywords and the total number of words in the conversation. Traverse all the conversation records and determine the emergency induction keyword density according to all the keyword densities. Determine the social behavior vector according to the social circle mutation rate and the emergency induction keyword density, where the target keywords include at least transfer, verification code, safe account, password expiration, and system upgrade.

[0016] According to the communication risk recognition method based on multi-modal behavior fusion provided by the present invention, the preset causal graph model includes a modeling enhancement layer, a feature encoding layer, and a dense connection layer;

[0017] Inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model, including:

[0018] The modeling enhancement layer is used to calculate the causal effect factor corresponding to each feature vector in the multi-dimensional feature vector using the front-door criterion, and perform Hadamard product fusion on the feature vector and the causal effect factor to obtain an enhanced feature;

[0019] The feature encoding layer is used to process the enhanced feature using a preset Softmax function to generate a normalized weight corresponding to the feature vector, determine a weighted feature vector according to each feature vector and the normalized weight, and traverse all feature vectors to obtain all weighted feature vectors;

[0020] The dense connection layer is used to fuse all weighted feature vectors to obtain a final feature vector, and perform dimensionality reduction and compression on the final feature vector to obtain a fusion vector.

[0021] According to the communication risk identification method based on multi-modal behavior fusion provided by the present invention, the fusing all weighted feature vectors to obtain a final feature vector includes:

[0022]

[0023] where F fusion is the final feature vector, s i is the normalized weight, is the feature vector.

[0024] According to the communication risk identification method based on multi-modal behavior fusion provided by the present invention, the TCN-Transformer hybrid model includes a TCN layer and a Transformer layer; inputting the fusion vector into the TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model, including:

[0025] Inputting the fusion vector into the TCN layer to obtain a first spatio-temporal feature;

[0026] Inputting the fusion vector into the Transformer layer to obtain a second spatio-temporal feature;

[0027] Performing feature fusion on the first spatio-temporal feature and the second spatio-temporal feature using tensor dot product to obtain a target risk probability value.

[0028] According to the communication risk identification method based on multi-modal behavior fusion provided by the present invention, before generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, the method further includes:

[0029] Determine an initial defense threshold based on historical attack samples, and adjust the initial defense threshold using the gradient information of the adversarial training loss function to obtain an adjusted defense threshold;

[0030] Obtain the network load impact value within the preset time period and the user sensitivity of the target terminal, and determine the preset dynamic defense threshold according to the adjusted defense threshold, the network load impact value, and the user sensitivity.

[0031] According to the communication risk identification method based on multi-modal behavior fusion provided by the present invention, the adjusting the initial defense threshold using the gradient information of the adversarial training loss function to obtain an adjusted defense threshold includes:

[0032]

[0033] where T(t) is the adjusted defense threshold, T0 is the initial defense threshold, γ is the learning rate coefficient for controlling the adjustment amplitude, is the reverse gradient of the attack success rate of the adversarial sample, P risk is the target risk probability value.

[0034] According to the communication risk identification method based on multi-modal behavior fusion provided by the present invention, the user sensitivity is determined according to the user occupation and user position of the target terminal; the determining the preset dynamic defense threshold according to the adjusted defense threshold, the network load impact value, and the user sensitivity includes:

[0035] T final (t) = T(t) × (1 + α × NL - β × UC)

[0036] where final T(t) is the preset dynamic defense threshold, T(t) is the adjusted defense threshold, α is the network load impact factor, β is the user sensitivity coefficient, NL is the network load impact value, and UC is the user sensitivity.

[0037] According to the communication risk identification method based on multi-modal behavior fusion provided by the present invention, the generating the target defense instruction according to the target risk probability value and the preset dynamic defense threshold includes:

[0038] When the target risk probability value is greater than or equal to the first risk threshold and less than the preset dynamic defense threshold, generate a first defense instruction, and the first defense instruction is used to indicate sending a risk text message to the target terminal;

[0039] When the target risk probability value is greater than or equal to the preset dynamic defense threshold and less than the second risk threshold, a second defense instruction is generated. The second defense instruction is used to restrict the network access permission of the APP with transfer function, and / or perform graphic verification code verification, and / or trigger device fingerprint review.

[0040] When the target risk probability value is greater than or equal to the second risk threshold, face recognition and voiceprint matching are triggered, and / or the execution time of the transfer operation is delayed.

[0041] In a second aspect, a communication risk identification system based on multi-modal behavior fusion is provided, including:

[0042] A fusion unit, which is used to fuse the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within a preset time period to obtain a multi-dimensional feature vector. The network environment vector is determined according to the WiFi type, VPN status, and the frequency of abnormal port detection events. The permission feature vector is determined according to the APP permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined according to the picture risk index and the voiceprint risk index. The social behavior vector is determined according to the social circle mutation rate and the density of emergency induction keywords.

[0043] A first input unit, which is used to input the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model.

[0044] A second input unit, which is used to input the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model.

[0045] A generation unit, which is used to generate a target defense instruction according to the target risk probability value and the preset dynamic defense threshold. The target defense instruction is used to instruct the target terminal to activate the target defense strategy.

[0046] The present invention solves the technical drawbacks existing in the existing communication risk identification methods, such as poor model generalization ability, low computational efficiency, insufficient fusion processing of multi-modal behavior features, etc. By fusing multi-dimensional feature vectors such as network environment vectors, permission feature vectors, multimedia vectors, and social behavior vectors, it can more comprehensively reflect the behavior characteristics of the target terminal during the communication process, thereby more accurately identifying potential communication risks. Using advanced machine learning algorithms and models, such as causal graph models, TCN-Transformer hybrid models, etc., it realizes real-time monitoring and early warning of communication risks, effectively reducing the false alarm rate and missed alarm rate, and improving the reliability of risk identification;

[0047] By introducing a dynamic defense strategy and a preset dynamic defense threshold, the present application can take corresponding defense measures according to the different degrees of communication risks, thereby enhancing the generalization ability and adaptability of the model, and better coping with complex and changeable communication environments and fraud means. The present invention not only improves the accuracy and efficiency of identification, but also can provide personalized security defense strategies according to the user's behavior characteristics and risk levels, thereby enhancing the user experience and communication security. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0049] Figure 1 is a schematic flowchart of a communication risk identification method based on multi-modal behavior fusion provided by the present invention;

[0050] Figure 2 is a schematic structural diagram of a communication risk identification system based on multi-modal behavior fusion provided by the present invention;

[0051] Figure 3 is a schematic structural diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0052] To make the objectives, technical solutions, and advantages of the present invention clearer, the following will clearly and completely describe the technical solutions in the present invention with reference to the accompanying drawings in the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative efforts based on the embodiments in the present invention belong to the scope of protection of the present invention.

[0053] Figure 1It is a schematic flowchart of the communication risk identification method based on multi-modal behavior fusion provided by the present invention. The communication risk identification method based on multi-modal behavior fusion includes:

[0054] Step 101: Fuse the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within a preset time period to obtain a multi-dimensional feature vector. The network environment vector is determined according to the WiFi type, VPN status, and abnormal port detection event frequency. The permission feature vector is determined according to the APP permission deviation index and sensitive permission combination risk index. The multimedia vector is determined according to the picture risk index and voiceprint risk index. The social behavior vector is determined according to the social circle mutation rate and emergency induction keyword density.

[0055] Step 102: Input the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model.

[0056] Step 103: Input the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model.

[0057] Step 104: Generate a target defense instruction according to the target risk probability value and a preset dynamic defense threshold. The target defense instruction is used to instruct the target terminal to activate a target defense strategy.

[0058] In step 101, before obtaining the multi-dimensional feature vector by fusing the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within a preset time period, the method further includes using One-Hot encoding to distinguish the home network, enterprise intranet, and public hotspot in the WiFi type, parsing the VPN identification bit in the VPN status through the TCP / IP protocol stack, and statistically counting the abnormal port detection event frequency based on a preset sliding time window, and compressing it to the [0,1] interval through logarithmic transformation to determine the network environment vector.

[0059] Optionally, the present invention constructs a multi-dimensional risk representation space through four types of heterogeneous feature vectors. Among them, in the acquisition of the network environment vector, One-Hot encoding is used to distinguish home network (001), enterprise intranet (010), and public hotspot (100). The VPN identification bit is parsed through the TCP / IP protocol stack, for example, binarized to 0 / 1. The time axis is divided into continuous preset duration windows. The number of abnormal port detection events is independently counted within each window, and the data within the window is updated in real time as new events arrive. When the old data exceeds the preset duration range, it is automatically eliminated to ensure that the statistical result reflects the activity characteristics within the latest preset duration. The total number of all port detection events within each window is counted as the original frequency value. For example, 100,000 abnormal detections are counted, and only 100 detections are counted in another window. The natural logarithm transformation is applied to the original frequency. After the logarithmic transformation, the data is compressed to [0,1] through linear mapping to ensure that all statistical results are within a unified comparable range. Finally, the WiFi type, VPN status, and number of port scans are combined into a network environment vector V with a dimension of 128. net 。

[0060] Optionally, before obtaining the multi-dimensional feature vector according to the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within the fusion preset period, the method further includes, for any APP in the target terminal, counting the application frequency of the common permissions of the same type of APP corresponding to the APP, constructing the reference probability distribution of each common permission, determining the actual probability distribution of each common permission according to the actual permission application list of the APP, calculating the reference probability distribution and the actual probability distribution based on the preset JS divergence to determine the JS divergence of the common permission, traversing each common permission in all APPs to determine the JS divergence of all common permissions, and determining the APP permission deviation index according to all JS divergences. The common permission is the permission shared by the APP and the same type of APP; inputting all the enabled permissions in the APP into a preset sensitive permission combination detection model to obtain the sensitive permission combination risk output by the preset sensitive permission combination detection model, traversing all APPs, and determining the sensitive permission combination risk index according to all sensitive permission combination risks; fusing the APP permission deviation index and the sensitive permission combination risk index to obtain the permission feature vector.

[0061] Optionally, by counting the application frequency of the permissions of the same type of APP, a reference probability distribution Q is established. For example, if the application rate of the location permission in the same type of APP is 80%, then Q(location)=0.8. The actual permission application list of the target APP is converted into a probability distribution P. For example, an APP applies for the location and contact list permissions, then P(location)=1 / 2. Calculate the reference probability distribution and the actual probability distribution based on the preset JS divergence to determine the JS divergence of the common permission:

[0062]

[0063] Among them, M = (P + Q) / 2 is the mixed distribution, and D KL is the KL divergence. The symmetry and boundedness (range [0, log2]) of the JS divergence enable it to stably quantify the abnormality degree of permission applications. In addition to location, all other common permissions can also be traversed, such as the camera, address book, etc., to determine the JS divergence of each of all common permissions, and determine the APP permission deviation index according to all JS divergences. The common permissions are the permissions shared by the APP and the same type of APP. The APP permission deviation index can be the average value of the JS divergence of each of all common permissions.

[0064] Those skilled in the art understand that if an APP that should not originally obtain permissions obtains relevant permissions, or if an APP that should not obtain permissions it should not obtain enables the corresponding permission operation, such an operation is considered to have a relatively high communication risk, and the enabled permissions are the abnormal permission combinations. For example, it is very unreasonable for a calculator APP to apply for address book and location permissions at the same time. The present invention can classify each APP, and for the same type of APP, design a corresponding preset sensitive permission combination detection model. The preset sensitive permission combination detection model is determined after training according to different sample permission combinations and the sample sensitive permission combination risks corresponding to each sample permission combination. Then, input all the enabled permissions in the APP into the preset sensitive permission combination detection model to obtain the sensitive permission combination risk output by the preset sensitive permission combination detection model. For each APP, determine its corresponding same type of APP, then traverse all APPs, obtain the sensitive permission combination risk corresponding to each APP, perform mean processing on all sensitive permission combination risks to determine the sensitive permission combination risk index. Finally, fuse the APP permission deviation index and the sensitive permission combination risk index to obtain the permission feature vector V perm 。

[0065] Optionally, before obtaining the multi-dimensional feature vector according to the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within the fusion preset time period, the method further includes extracting all the pictures received within the preset time period. For each picture, input the picture into a preset picture risk model to obtain the picture risk degree output by the preset picture risk model. Traverse all the pictures and determine the picture risk index according to each picture risk degree corresponding to all the pictures; extract all the voiceprint information received within the preset time period. For each voiceprint information, extract the voiceprint MFCC feature, and perform a similarity match between the voiceprint MFCC feature and the fraud voice features in the preset fraud voice database to obtain the voiceprint similarity. Traverse all the voiceprint information and determine the voiceprint risk index according to all the voiceprint similarities. Determine the multimedia vector according to the picture risk index and the voiceprint risk index.

[0066] Optionally, the abnormal pictures with risks referred to in the present invention mainly identify those pictures generated by AI, such as those that violate biometric abnormalities, such as abnormal joint angles and abnormal light reflections, such as those that violate physical laws, such as no obvious wrinkles or deformations of a person in a squeezed state, and an object having multiple shadows in different directions with different shadow lengths, etc. These pictures do not actually exist. The present invention can determine the sample risk index of each sample picture based on the detection formula of the StegDetect algorithm, processing spatial domain images and frequency domain DCT coefficients, etc., or based on techniques such as analyzing steganographic features based on discrete cosine transform (DCT) coefficients. Then, construct a preset picture risk model according to each sample risk index of all sample pictures, so that after inputting the picture into the preset picture risk model, the picture risk degree can be obtained. Traverse all the pictures and perform an averaging process on each picture risk degree corresponding to all the pictures to determine the picture risk index. Further, for each voiceprint information, the Mel-frequency cepstral coefficients (MFCC) are the core features of voiceprint recognition. Extract the voiceprint MFCC feature, and the voiceprint MFCC feature is similar to a voice ID card. The similarity match between the voiceprint MFCC feature and the fraud voice features in the preset fraud voice database to obtain the voiceprint similarity includes:

[0067]

[0068] Among them, is the voiceprint MFCC feature, is the fraud voice feature in any preset fraud voice database, T is the number of fraud voice features in the preset fraud voice database, that is, traverse all the voiceprint information, determine the voiceprint risk index according to all the voiceprint similarities, and finally determine the multimedia vector V according to the picture risk index and the voiceprint risk index. media, the present invention can compress the original high-dimensional features to 128 dimensions through PCA, and at the same time, a cross-attention mechanism can be introduced to enhance the picture risk index and the voiceprint risk index with each other.

[0069] Optionally, before obtaining the multi-dimensional feature vector according to the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within the fusion preset time period, the method further includes determining the social circle mutation rate according to the number of newly added contacts of the target terminal within the preset time period and the historical average number of newly added contacts, obtaining the session record of each APP of the target terminal within the preset time period, and for each session record, determining the keyword density of the session record according to the target keyword and the total number of words in the session record, traversing all session records, determining the emergency-induced keyword density according to all keyword densities, and determining the social behavior vector according to the social circle mutation rate and the emergency-induced keyword density, where the target keyword at least includes transfer, verification code, security account, password expiration, and system upgrade.

[0070] Optionally, determining the social circle mutation rate according to the number of newly added contacts of the target terminal within the preset time period and the historical average number of newly added contacts includes:

[0071]

[0072] In an alternative embodiment, the historical average number of newly added contacts is the average value of the most recent 8 weeks, the number of newly added contacts within the preset time period is the number of newly added contacts this week, and the historical standard deviation is the degree of data dispersion in the same period.

[0073] Optionally, for the emergency-induced keyword density, the present invention first performs text content conversion and extraction on the session record to obtain the target keyword and the total number of words in the session record, where the target keyword at least includes transfer, verification code, security account, password expiration, and system upgrade, and then determines the keyword density of the session record according to the target keyword and the total number of words in the session record, such as determining the proportion of the target keyword in the session record in the total number of words in the session record, determining the keyword density of the session record, traversing all session records of the target terminal within the preset time period, and then determining the keyword density corresponding to each session record, determining the emergency-induced keyword density according to the mean value of all keyword densities, and finally, fusing the social circle mutation rate and the emergency-induced keyword density to determine the social behavior vector V social 。

[0074] In step 101, fuse the network environment vector V of the target terminal during the communication process within the preset time period net 、permission feature vector Vperm and the multimedia vector V media as well as the social behavior vector V social , to obtain the multi-dimensional feature vector [V net , V perm , V media , V social ∈ R 640 . In other embodiments, the adversarial domain adaptation alignment technology can also be used to eliminate the feature distribution differences, and the network environment vector V net , the permission feature vector V perm , the multimedia vector V media as well as the social behavior vector V social in the communication process are aligned, and then the multi-dimensional feature vector is determined. Specifically, to eliminate the multi-source feature distribution differences, a dual alignment mechanism is used to unify the cross-modal feature space, and Z-Score normalization is performed on each feature dimension. A reference distribution Vref is introduced, usually taking the mixed distribution of all samples in the training set. The distribution difference is calculated through the Gaussian kernel function, and a generative adversarial network framework is constructed to further align the feature distribution. By integrating the results of standardization and adversarial training, the aligned features are obtained.

[0075] In step 102, the preset causal graph model includes a modeling enhancement layer, a feature encoding layer, and a dense connection layer;

[0076] Inputting the multi-dimensional feature vector into the preset causal graph model to obtain a fusion vector output by the preset causal graph model includes:

[0077] The modeling enhancement layer is used to calculate the causal effect factor corresponding to each feature vector in the multi-dimensional feature vector by using the front-door criterion, and perform Hadamard product fusion on the feature vector and the causal effect factor to obtain the enhanced feature;

[0078] The feature encoding layer is used to process the enhanced feature by using a preset Softmax function to generate the normalized weight corresponding to the feature vector, determine the weighted feature vector according to each feature vector and the normalized weight, and traverse all feature vectors to obtain all weighted feature vectors;

[0079] The dense connection layer is used to fuse all weighted feature vectors to obtain the final feature vector, and perform dimensionality reduction and compression on the final feature vector to obtain the fusion vector.

[0080] Optionally, the present invention can construct a directed acyclic graph (DAG) based on network environment, privilege abuse, multimedia risk, social anomaly, and communication risk to describe the causal relationship between features and risk labels. Based on conditional independence testing (PC algorithm) and Granger causality test, the impact path of features on risk is quantified, and the causal effect factor C corresponding to each feature vector is calculated using the front-door criterion i including:

[0081]

[0082] Among them, do(X i ) is simulated through feature resampling, and the average treatment effect (ATE) is calculated using the Potential Outcomes framework. For example, when the VPN is forcibly closed, the risk probability increases by 0.23. Further, the causal effect factor C i is element-wise fused with the aligned feature V i to obtain the enhanced feature

[0083] The normalized weights are generated through the Softmax function:

[0084]

[0085] Among them, exp is the natural exponential function, W is the learnable weight matrix, T is the matrix transpose, and the present invention introduces the causal effect factor C i to constrain the weight allocation direction and suppress non-causal association dimensions.

[0086] Further, fusing all the weighted feature vectors to obtain the final feature vector, including:

[0087]

[0088] Among them, F fusion is the final feature vector, a i is the normalized weight, is the feature vector. Adversarial samples can also be injected during the training phase to ensure weight stability. The 640-dimensional fused vector is compressed to 512 dimensions through a dense connection layer, and the KL divergence is used to constrain the distribution consistency before and after dimensionality reduction, and the high-contribution feature combinations are visualized through gradient backpropagation.

[0089] In step 103, the TCN-Transformer hybrid model includes a TCN layer and a Transformer layer; inputting the fused vector into the TCN-Transformer hybrid model to obtain the target risk probability value output by the TCN-Transformer hybrid model, including:

[0090] Input the fused vector into the TCN layer to obtain the first spatio-temporal feature;

[0091] Input the fused vector into the Transformer layer to obtain the second spatio-temporal feature;

[0092] Perform feature fusion on the first spatio-temporal feature and the second spatio-temporal feature using tensor dot product to obtain the target risk probability value.

[0093] In such an embodiment, step 103 receives the 512-dimensional causal attention fusion vector Ffusion output by step 102 as input, and realizes multi-level modeling of spatio-temporal features through a TCN-Transformer hybrid model. This model combines the local temporal capture ability of the temporal convolutional network (TCN) and the global cross-dimensional interaction characteristics of Transformer. The TCN uses causal convolution (CausalConvolution) to ensure the strict causality of temporal modeling, introduces a dilation rate (DilationRate) d = 2^l (l is the number of layers), so that the receptive field of the l-th layer expands to Receptive Field = (K - 1) × d + 1. When K = 5 and 4 layers are stacked, the maximum receptive field reaches 72 hours. The problem of gradient disappearance is alleviated through residual connection (Residual Connection). The TCN layer outputs the local feature matrix Htcn in the time dimension, that is, the first spatio-temporal feature, where T = 72 hours is the sliding window length, capturing high-frequency fluctuations, periodic behaviors, and trend changes.

[0094] Further, input the fused vector F fusion into the Transformer layer, extract cross-dimensional associations through multi-head self-attention (MSA), set 8 attention heads to capture the interaction patterns of different feature combinations such as permission-network and multimedia-social, introduce a two-stage attention (TSA) mechanism, calculate the attention weights in the time dimension, strengthen key time points (such as the moment of attack), and use a router mechanism (Router) to dynamically screen high-correlation feature combinations, and output the interaction feature matrix H trans , that is, the second spatio-temporal feature.

[0095] Performing feature fusion on the first spatio-temporal feature and the second spatio-temporal feature using tensor dot product to obtain the target risk probability value includes:

[0096]

[0097] Among them, the dot product operation strengthens the spatio-temporal consistency feature, the Sigmoid function compresses the score into the interval [0, 1] and maps it to the risk probability. The TCN captures the fine-grained temporal patterns within 72 hours (such as the hourly port scanning frequency), and the Transformer mines the non-linear associations across permissions, multimedia, and social dimensions to achieve multi-scale coverage of risk identification.

[0098] In step 104, the risk probability value and real-time environment parameters output in step 103 are received (such as network load, device location, and user identity sensitivity), and an intelligent generation of the defense strategy is realized through the adversarial enhanced dynamic threshold algorithm. This mechanism breaks through the limitations of traditional static thresholds and realizes the real-time adaptation of defense response and attack situation through gradient backpropagation and game theory optimization.

[0099] Optionally, before generating the target defense instruction according to the target risk probability value and the preset dynamic defense threshold, the method further includes:

[0100] Determine the initial defense threshold according to historical attack samples, and adjust the initial defense threshold using the gradient information of the adversarial training loss function to obtain the adjusted defense threshold;

[0101] Obtain the network load impact value within the preset time period and the user sensitivity of the target terminal, and determine the preset dynamic defense threshold according to the adjusted defense threshold, the network load impact value, and the user sensitivity.

[0102] Optionally, determine the initial defense threshold according to historical attack samples, for example, T0 = μ attack + 3σ attack where μ attack is the average risk value of historical attack events, and σ attack is the standard deviation of attack samples. If μ attack is 0.52 and σ attack is 0.06, then T0 is 0.7.

[0103] Optionally, the adjusting the initial defense threshold using the gradient information of the adversarial training loss function to obtain the adjusted defense threshold includes:

[0104]

[0105] where T(t) is the adjusted defense threshold, T0 is the initial defense threshold, γ is the learning rate coefficient controlling the adjustment amplitude, is the reverse gradient of the attack success rate of the adversarial sample, and P riSk is the target risk probability value.

[0106] Optionally, the user sensitivity is determined according to the user's occupation and position of the target terminal; determining the preset dynamic defense threshold according to the adjusted defense threshold, the network load influence value, and the user sensitivity includes:

[0107] T final (t) = T(t) × (1 + α × NL - β × UC)

[0108] where T final (t) is the preset dynamic defense threshold, T(t) is the adjusted defense threshold, α is the network load influence factor, β is the user sensitivity coefficient, NL is the network load influence value, and UC is the user sensitivity.

[0109] Optionally, generating the target defense instruction according to the target risk probability value and the preset dynamic defense threshold includes:

[0110] When the target risk probability value is greater than or equal to the first risk threshold and less than the preset dynamic defense threshold, generating a first defense instruction for instructing to send a risk text message to the target terminal;

[0111] When the target risk probability value is greater than or equal to the preset dynamic defense threshold and less than the second risk threshold, generating a second defense instruction for restricting the network access permission of the APP with the transfer function, and / or performing graphic verification code verification, and / or triggering device fingerprint review;

[0112] When the target risk probability value is greater than or equal to the second risk threshold, triggering face recognition and voiceprint matching, and / or delaying the execution time of the transfer operation.

[0113] According to the comparison results of the target risk probability value with the preset dynamic defense threshold, the first risk threshold, and the second risk threshold, the present invention generates different defense instructions, such as sending risk text messages, restricting the network access permission of the APP, performing graphic verification code verification, triggering device fingerprint review, face recognition and voiceprint matching, delaying the transfer operation, etc., provides a specific method for generating defense instructions according to the risk probability value, makes the defense measures more specific and operable, and improves the timeliness and accuracy of risk response.

[0114] The present invention solves the technical drawbacks existing in the existing communication risk identification methods, such as poor model generalization ability, low computing efficiency, insufficient fusion processing of multi-modal behavior features, etc. By fusing multi-dimensional feature vectors such as network environment vectors, permission feature vectors, multimedia vectors, and social behavior vectors, it can more comprehensively reflect the behavior characteristics of the target terminal during the communication process, thereby more accurately identifying potential communication risks. Using advanced machine learning algorithms and models, such as causal graph models, TCN-Transformer hybrid models, etc., it realizes real-time monitoring and early warning of communication risks, effectively reducing the false alarm rate and missed alarm rate, and improving the reliability of risk identification;

[0115] By introducing a dynamic defense strategy and a preset dynamic defense threshold, the present application can take corresponding defense measures according to the different degrees of communication risks, thereby enhancing the generalization ability and adaptability of the model, and better coping with complex and changeable communication environments and fraud means. The present invention not only improves the accuracy and efficiency of identification, but also can provide personalized security defense strategies according to the behavior characteristics and risk levels of users, thereby enhancing the user experience and communication security.

[0116] Figure 2 It is a schematic structural diagram of a communication risk identification system based on multi-modal behavior fusion provided by the present invention. The communication risk identification system based on multi-modal behavior fusion includes a fusion unit 1. The fusion unit 1 is used to fuse the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within a preset time period to obtain a multi-dimensional feature vector. The network environment vector is determined according to the WiFi type, VPN status, and the frequency of abnormal port detection events. The permission feature vector is determined according to the APP permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined according to the picture risk index and the voiceprint risk index. The social behavior vector is determined according to the social circle mutation rate and the density of emergency induction keywords. The working principle of the fusion unit 1 can refer to the foregoing step 101 and will not be elaborated here.

[0117] The communication risk identification system based on multi-modal behavior fusion further includes a first input unit 2. The first input unit 2 is used to input the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model. The working principle of the first input unit 2 can refer to the foregoing step 102 and will not be elaborated here.

[0118] The communication risk identification system based on multimodal behavior fusion further includes a second input unit 3. The second input unit 3 is used to input the fusion vector into the TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model. The working principle of the second input unit 3 can refer to the foregoing step 103 and will not be elaborated here.

[0119] The communication risk identification system based on multimodal behavior fusion further includes a generation unit 4. The generation unit 4 is used to generate a target defense instruction according to the target risk probability value and a preset dynamic defense threshold. The target defense instruction is used to instruct the target terminal to activate a target defense strategy. The working principle of the generation unit 4 can refer to the foregoing step 104 and will not be elaborated here.

[0120] The present invention solves the technical drawbacks existing in the existing communication risk identification methods, such as poor model generalization ability, low calculation efficiency, insufficient fusion processing of multimodal behavior features, etc. By fusing multi-dimensional feature vectors such as network environment vectors, permission feature vectors, multimedia vectors, and social behavior vectors, it can more comprehensively reflect the behavior characteristics of the target terminal during the communication process, thereby more accurately identifying potential communication risks. Using advanced machine learning algorithms and models, such as causal graph models, TCN-Transformer hybrid models, etc., it realizes real-time monitoring and early warning of communication risks, effectively reduces the false alarm rate and missed alarm rate, and improves the reliability of risk identification;

[0121] By introducing a dynamic defense strategy and a preset dynamic defense threshold, the present application can take corresponding defense measures according to the different degrees of communication risks, thereby enhancing the generalization ability and adaptability of the model, and better coping with complex and changeable communication environments and fraud means. The present invention not only improves the accuracy and efficiency of identification, but also can provide personalized security defense strategies according to the behavior characteristics and risk levels of users, thereby enhancing the user experience and communication security.

[0122] Figure 3 is a schematic structural diagram of the electronic device provided by the present invention. As Figure 3As shown in the figure, the electronic device may include: a processor 110, a communications interface 120, a memory 130, and a communication bus 140. Among them, the processor 110, the communications interface 120, and the memory 130 complete communication with each other through the communication bus 140. The processor 110 may call the logical instructions in the memory 130 to execute a communication risk identification method based on multi-modal behavior fusion. The method includes: fusing the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within a preset time period to obtain a multi-dimensional feature vector. The network environment vector is determined according to the WiFi type, VPN status, and the frequency of abnormal port detection events. The permission feature vector is determined according to the APP permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined according to the picture risk index and the voiceprint risk index. The social behavior vector is determined according to the social circle mutation rate and the density of emergency induction keywords. Inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model. Inputting the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model. Generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold. The target defense instruction is used to instruct the target terminal to activate a target defense strategy.

[0123] In addition, the logical instructions in the above-mentioned memory 130 can be implemented in the form of software functional units and, when sold or used as an independent product, can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0124] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute a communication risk identification method based on multi-modal behavior fusion provided by each of the above methods. The method includes: fusing a network environment vector, a permission feature vector, a multimedia vector, and a social behavior vector of a target terminal during a communication process within a preset time period to obtain a multi-dimensional feature vector. The network environment vector is determined according to the WiFi type, the VPN status, and the frequency of abnormal port detection events. The permission feature vector is determined according to the APP permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined according to the picture risk index and the voiceprint risk index. The social behavior vector is determined according to the social circle mutation rate and the density of emergency induction keywords; inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model; inputting the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model; generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, and the target defense instruction is used to instruct the target terminal to activate a target defense strategy.

[0125] On another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements a communication risk identification method based on multi-modal behavior fusion provided by each of the above methods. The method includes: fusing a network environment vector, a permission feature vector, a multimedia vector, and a social behavior vector of a target terminal during a communication process within a preset time period to obtain a multi-dimensional feature vector. The network environment vector is determined according to the WiFi type, the VPN status, and the frequency of abnormal port detection events. The permission feature vector is determined according to the APP permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined according to the picture risk index and the voiceprint risk index. The social behavior vector is determined according to the social circle mutation rate and the density of emergency induction keywords; inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model; inputting the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model; generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, and the target defense instruction is used to instruct the target terminal to activate a target defense strategy.

[0126] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative labor.

[0127] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments or perform equivalent replacements for some of the technical features. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A communication risk identification method based on multi-modal behavior fusion, characterized in that, Including: Fusing the network environment vector, permission feature vector, multimedia vector, and social behavior vector during the communication process of the target terminal within a preset time period to obtain a multi-dimensional feature vector. The network environment vector is determined based on the WiFi type, VPN status, and the frequency of abnormal port detection events. The permission feature vector is determined based on the APP permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined based on the picture risk index and the voiceprint risk index. The social behavior vector is determined based on the social circle mutation rate and the density of emergency induction keywords; Inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model; Inputting the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model; Generating a target defense instruction based on the target risk probability value and a preset dynamic defense threshold. The target defense instruction is used to instruct the target terminal to activate a target defense strategy.

2. The communication risk identification method based on multi-modal behavior fusion according to claim 1, wherein Before obtaining the multi-dimensional feature vector by fusing the network environment vector, permission feature vector, multimedia vector, and social behavior vector during the communication process of the target terminal within a preset time period, the method further includes: Using One-Hot encoding to distinguish the home network, enterprise intranet, and public hotspot in the WiFi type, parsing the VPN identification bit in the VPN status through the TCP / IP protocol stack, statistically calculating the frequency of abnormal port detection events based on a preset sliding time window, compressing it to the [0,1] interval through logarithmic transformation, and determining the network environment vector; For any APP in the target terminal, statistically calculating the application frequency of the common permissions of the same type of APP corresponding to the APP, constructing the baseline probability distribution of each common permission, determining the actual probability distribution of each common permission according to the actual permission application list of the APP, calculating the JS divergence between the baseline probability distribution and the actual probability distribution based on a preset JS divergence, determining the JS divergence of each common permission, traversing each common permission in all APPs, determining the JS divergence of each common permission, and determining the APP permission deviation index according to all JS divergences. The common permission is the permission shared by the APP and the same type of APP; inputting all the enabled permissions in the APP into a preset sensitive permission combination detection model to obtain the sensitive permission combination risk output by the preset sensitive permission combination detection model, traversing all APPs, and determining the sensitive permission combination risk index according to all sensitive permission combination risks; fusing the APP permission deviation index and the sensitive permission combination risk index to obtain the permission feature vector; Extract all the pictures received within the preset time period. For each picture, input the picture into a preset picture risk model to obtain the picture risk degree output by the preset picture risk model. Traverse all the pictures and determine the picture risk index according to each picture risk degree corresponding to all the pictures. Extract all the voiceprint information received within the preset time period. For each voiceprint information, extract the voiceprint MFCC features, perform similarity matching between the voiceprint MFCC features and the fraud voice features in the preset fraud voice database to obtain the voiceprint similarity. Traverse all the voiceprint information and determine the voiceprint risk index according to all the voiceprint similarities. Determine the multimedia vector according to the picture risk index and the voiceprint risk index; Determine the social circle mutation rate according to the number of newly added contacts of the target terminal within the preset time period and the historical average number of newly added contacts. Obtain the conversation records of each APP of the target terminal within the preset time period. For each conversation record, determine the keyword density of the conversation record according to the target keywords and the total number of words in the conversation. Traverse all the conversation records and determine the emergency induction keyword density according to all the keyword densities. Determine the social behavior vector according to the social circle mutation rate and the emergency induction keyword density. The target keywords include at least transfer, verification code, secure account, password expiration, and system upgrade.

3. The communication risk identification method based on multi-modal behavior fusion according to claim 1, wherein The preset causal graph model includes a modeling enhancement layer, a feature encoding layer, and a dense connection layer; Inputting the multi-dimensional feature vector into the preset causal graph model to obtain a fusion vector output by the preset causal graph model includes: The modeling enhancement layer is used to calculate the causal effect factor corresponding to each feature vector in the multi-dimensional feature vector by using the front-door criterion, and perform Hadamard product fusion on the feature vector and the causal effect factor to obtain the enhanced feature; The feature encoding layer is used to process the enhanced feature by using a preset Softmax function to generate the normalized weight corresponding to the feature vector, determine the weighted feature vector according to each feature vector and the normalized weight, and traverse all the feature vectors to obtain all the weighted feature vectors; The dense connection layer is used to fuse all the weighted feature vectors to obtain the final feature vector, and perform dimensionality reduction and compression on the final feature vector to obtain the fusion vector.

4. The communication risk identification method based on multi-modal behavior fusion according to claim 3, wherein Fusing all the weighted feature vectors to obtain the final feature vector includes: Among them, F fusion is the final feature vector, a i is the normalized weight, is the feature vector.

5. The communication risk identification method based on multi-modal behavior fusion according to claim 1, characterized in that, The TCN-Transformer hybrid model includes a TCN layer and a Transformer layer. Inputting the fusion vector into the TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model includes: Input the fusion vector into the TCN layer to obtain the first spatio-temporal feature; Input the fusion vector into the Transformer layer to obtain the second spatio-temporal feature; Perform feature fusion on the first spatio-temporal feature and the second spatio-temporal feature by using tensor dot product to obtain the target risk probability value.

6. The communication risk identification method based on multi-modal behavior fusion according to claim 1, wherein Before generating a target defense instruction based on the target risk probability value and a preset dynamic defense threshold, the method further includes: Determining an initial defense threshold based on historical attack samples, and adjusting the initial defense threshold by using gradient information of an adversarial training loss function to obtain an adjusted defense threshold; Obtaining a network load impact value within the preset time period and user sensitivity of the target terminal, and determining the preset dynamic defense threshold according to the adjusted defense threshold, the network load impact value, and the user sensitivity.

7. The communication risk identification method based on multimodal behavior fusion according to claim 6, wherein The adjusting the initial defense threshold by using gradient information of an adversarial training loss function to obtain an adjusted defense threshold includes: Among them, T(t) is the adjusted defense threshold, T0 is the initial defense threshold, and γ is the learning rate coefficient that controls the adjustment amplitude. is the reverse gradient of the adversarial sample attack success rate, P risk is the target risk probability value.

8. The communication risk identification method based on multi-modal behavior fusion according to claim 7, characterized in that The user sensitivity is determined according to the user occupation and user position of the target terminal; the determining the preset dynamic defense threshold according to the adjusted defense threshold, the network load impact value, and the user sensitivity includes: T final (t) = T(t) × (1 + α × NL - β × UC) Among them, T final (t) is the preset dynamic defense threshold, T(t) is the adjusted defense threshold, α is the network load impact factor, β is the user sensitivity coefficient, NL is the network load impact value, and UC is the user sensitivity.

9. The communication risk identification method based on multi-modal behavior fusion according to claim 1, wherein The generating a target defense instruction according to the target risk probability value and the preset dynamic defense threshold includes: When the target risk probability value is greater than or equal to a first risk threshold and less than the preset dynamic defense threshold, generating a first defense instruction for instructing to send a risk message to the target terminal; When the target risk probability value is greater than or equal to the preset dynamic defense threshold and less than a second risk threshold, generating a second defense instruction for restricting network access permissions of an APP with a transfer function, and / or performing graphic verification code verification, and / or triggering device fingerprint review; When the target risk probability value is greater than or equal to the second risk threshold, triggering face recognition and voiceprint matching, and / or delaying the execution time of a transfer operation.

10. A communication risk identification system based on multi-modal behavior fusion, characterized in that, including: A fusion unit configured to fuse a network environment vector, a permission feature vector, a multimedia vector, and a social behavior vector during communication of a target terminal within a preset time period to obtain a multi-dimensional feature vector, where the network environment vector is determined according to a WiFi type, a VPN status, and the frequency of abnormal port detection events, the permission feature vector is determined according to an APP permission deviation index and a sensitive permission combination risk index, the multimedia vector is determined according to a picture risk index and a voiceprint risk index, and the social behavior vector is determined according to a social circle mutation rate and an emergency induction keyword density; A first input unit configured to input the multi-dimensional feature vector into a preset causal graph model to obtain a fused vector output by the preset causal graph model; A second input unit configured to input the fused vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model; A generating unit configured to generate a target defense instruction according to the target risk probability value and the preset dynamic defense threshold, where the target defense instruction is used to instruct the target terminal to activate a target defense strategy.

Images