Push-in information processing method and device

Abstract

The invention discloses a push-in information processing method and device. The method comprises the following steps: analyzing a target short message point-to-point protocol data packet sent by a calling number, and judging whether short message information in the target short message point-to-point protocol data packet is push-in information or not according to an obtained analysis result; when the short message information in the target short message point-to-point protocol data packet is push-in information, determining a target short message text corresponding to the push-in information in the target short message point-to-point protocol data packet according to the analysis result; analyzing the target short message text by using the abnormal short message classification model to obtain an abnormal probability of the target short message text; and determining a processing operation executed on the push-in information in the target short message point-to-point protocol data packet according to a size relationship between the abnormal probability and a preset threshold value. The technical problem that the false alarm rate is high due to the fact that variable abnormal push-in short messages cannot be accurately recognized by adopting a fixed rule is solved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a push-in information processing method and apparatus. Background Technology

[0002] In the current telecommunications network environment, WAP PUSH messages (also known as push notifications or push messages) are highly favored by marketing and user services due to their convenient rich media content transmission features. WAP PUSH messages can contain text, links, images, audio, and video, and are presented directly to users through the mobile phone screen, significantly improving the effectiveness of information delivery and user interactivity.

[0003] However, while push notifications provide a rich user experience, they inevitably face the problem of abuse. For example, criminals often use virtual operator mobile phone numbers or SP numbers (dedicated numbers for Category II value-added telecommunications services) to send push notifications containing links to fake or malicious applications, deceiving users and causing them financial losses. Traditional filtering methods based on static and fixed rules often struggle to keep up with the rapid changes and increasing complexity of illegal methods, resulting in an inability to accurately filter abnormal push notifications and a high false alarm rate. That is, while blocking abnormal push notifications, they may also mistakenly block legitimate push notifications, affecting user experience and service quality.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a push notification processing method and apparatus to at least solve the technical problem that using fixed rules cannot accurately identify variable abnormal push notifications, resulting in a high false alarm rate.

[0006] According to one aspect of the embodiments of this application, a push-in information processing method is provided, comprising: parsing a target short message point-to-point protocol data packet sent by a calling number, and determining whether the short message information in the target short message point-to-point protocol data packet is push-in information based on the obtained parsing result; when the short message information in the target short message point-to-point protocol data packet is push-in information, determining the target SMS text corresponding to the push-in information in the target short message point-to-point protocol data packet based on the parsing result; analyzing the target SMS text using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text; and determining the processing operation to be performed on the push-in information in the target short message point-to-point protocol data packet based on the relationship between the abnormal probability and a preset threshold value, wherein the processing operation includes: an interception operation or a release operation.

[0007] Optionally, the target short message point-to-point protocol data packet sent by the calling number is parsed, and the short message information in the target short message point-to-point protocol data packet is determined based on the parsing result. This includes: parsing the target short message point-to-point protocol data packet sent by the calling number to obtain a message header and a message body, wherein the message body contains at least one of the following fields: an extended service mode category field and a short message field, and the extended service mode category field contains eight bytes; when the sixth byte of the extended service mode category field is set, it is determined that the non-text information of the user data header field in the short message field meets a preset condition; when the non-text information of the user data header field meets the preset condition, the short message information in the target short message point-to-point protocol data packet is determined to be a pushed message; when the sixth byte of the extended service mode category field is not set, or when the sixth byte of the extended service mode category field is set but the non-text information of the user data header field in the short message field does not meet the preset condition, the short message information in the target short message point-to-point protocol data packet is determined to be a pushed message.

[0008] Optionally, determining the target SMS text corresponding to the pushed information in the target short message peer-to-peer protocol data packet based on the parsing results includes: determining the control information of the pushed information in the target short message peer-to-peer protocol data packet based on the parsing results, wherein the control information includes at least: subject, short link, and transcoding identifier; and reconstructing the pushed information in the target short message peer-to-peer protocol data packet based on the control information to obtain the target SMS text.

[0009] Optionally, the multiple fields also include: a source address field, wherein the control information for determining the pushed information within the target short message peer-to-peer protocol data packet based on the parsing result includes: extracting the Radio Access Protocol (RAP) binary Extensible Markup Language (XML) content of the pushed information within the target short message peer-to-peer protocol data packet from the short message field; parsing the RAP binary XML content using a preset parsing library to extract the subject and short link of the pushed information within the target short message peer-to-peer protocol data packet; determining whether the calling number in the source address field matches the calling number corresponding to the target short message peer-to-peer protocol data packet, and determining the transcoding identifier of the pushed information within the target short message peer-to-peer protocol data packet based on the determination result.

[0010] Optionally, the training process of the abnormal SMS classification model includes: acquiring multiple sets of training sample data, wherein each set of training sample data includes: SMS text as training sample, and the category label corresponding to the SMS text as the corresponding sample label, and the category label includes: normal label and abnormal label; constructing a neural network model, wherein the neural network model includes at least: a feature extraction network and a classifier; training the neural network model using multiple sets of training sample data, and during the training process, using an optimizer to update the model parameters, calculating the loss function through the backpropagation algorithm, and obtaining the trained abnormal SMS classification model when the loss function meets the preset convergence condition.

[0011] Optionally, multiple sets of training sample data are obtained, including: obtaining multiple short message information point-to-point protocol data packets corresponding to the pushed information of different category labels; for each short message information point-to-point protocol data packet, parsing the short message information point-to-point protocol data packet, and determining the SMS text of the corresponding pushed information based on the obtained parsing results, and performing text enhancement on the SMS text; using the SMS text or enhanced SMS text of the pushed information in each short message information point-to-point protocol data packet and the corresponding category label as training samples and sample labels respectively, to obtain multiple sets of training sample data.

[0012] Optionally, the abnormal SMS text is analyzed using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text, including: using the feature extraction network in the abnormal SMS classification model to extract features of the control information in the target SMS text to obtain the corresponding control feature vector; and using the classifier in the abnormal SMS classification model to analyze the control feature vector to obtain the abnormal probability that the control feature vector belongs to the abnormal category.

[0013] According to another aspect of the embodiments of this application, a push-in information processing device is also provided, comprising: a judgment module, configured to parse a target short message point-to-point protocol data packet sent by a calling number, and determine whether the short message information in the target short message point-to-point protocol data packet is push-in information based on the obtained parsing result; a determination module, configured to determine the target SMS text corresponding to the push-in information in the target short message point-to-point protocol data packet based on the parsing result when the short message information in the target short message point-to-point protocol data packet is push-in information; a classification module, configured to analyze the target SMS text using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text; and a processing module, configured to determine the processing operation to be performed on the push-in information in the target short message point-to-point protocol data packet based on the relationship between the abnormal probability and a preset threshold value, wherein the processing operation includes: an interception operation or a release operation.

[0014] According to another aspect of the embodiments of this application, a computer program product is also provided, the computer program product comprising: a computer program, wherein the computer program, when executed by a processor, implements the above-described push information processing method.

[0015] According to another aspect of the embodiments of this application, an electronic device is also provided, the electronic device including: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described push information processing method through the computer program.

[0016] In this embodiment, deep parsing of the target SMS point-to-point protocol data packet sent by the calling number is employed to determine whether the SMS information is a push notification. If the SMS information within the target SMS point-to-point protocol data packet is confirmed to be a push notification, the push notification is reconstructed to obtain the corresponding target SMS text. An abnormal SMS classification model is then used to extract and analyze key features within the target SMS text to obtain the abnormal probability of the target SMS text. Finally, based on the relationship between this abnormal probability and a preset threshold, a rapid decision is made to execute an interception or release operation. This effectively improves the response speed and prevention efficiency for abnormal push notifications, achieving the goal of efficient and accurate prevention of abnormal WAP Push SMS messages, significantly enhancing the security of telecommunications networks and the reliability of user communications. Furthermore, it solves the technical problem that using fixed rules cannot accurately identify the ever-changing abnormal push notifications, leading to a high false alarm rate. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a flowchart illustrating an optional push information processing method according to an embodiment of this application;

[0019] Figure 2 This is a schematic diagram illustrating an optional subject extraction method according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram illustrating an optional short link extraction method according to an embodiment of this application;

[0021] Figure 4 This is a schematic diagram of the structure of an optional push-in information processing device according to an embodiment of this application;

[0022] Figure 5 This is a schematic diagram of the hardware structure of an optional computer terminal for implementing a push-in information processing method according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] To better understand the embodiments of this application, the following is a translation and explanation of some nouns or terms that appear in the description of the embodiments of this application:

[0026] Short Message Peer-to-Peer (SMPP) is a protocol used for sending and receiving SMS messages, typically used in mobile communication networks. It allows applications to send and receive SMS messages through a Short Message Service Center (SMSC).

[0027] WAP Push: Also known as service information or push message, it is a special format of SMS that can send links to a website or service to mobile phones that support WAP Push functionality. Users can then directly access the relevant service by clicking the link in the SMS, thus achieving a seamless integration of SMS and WAP (Wireless Application Protocol) services.

[0028] Example 1

[0029] According to an embodiment of this application, a push information processing method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0030] Figure 1 This is a flowchart illustrating a push-in information processing method according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0031] Step S102: Parse the target short message point-to-point protocol data packet sent by the calling number, and determine whether the short message information in the target short message point-to-point protocol data packet is a push message based on the parsing result.

[0032] Step S104: When the short message information in the target short message peer-to-peer protocol data packet is push information, determine the target SMS text corresponding to the push information in the target short message peer-to-peer protocol data packet based on the parsing result.

[0033] Step S106: Analyze the target SMS text using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text.

[0034] Step S108: Determine the processing operation to be performed on the pushed information in the target short message point-to-point protocol data packet based on the relationship between the abnormal probability and the preset threshold value. The processing operation includes: interception operation or release operation.

[0035] Based on the scheme defined in steps S102 to S108 above, it can be understood that in this embodiment, deep analysis is performed on the target short message point-to-point protocol data packet sent by the calling number to determine whether the short message information is push information. When it is confirmed that the short message information in the target short message point-to-point protocol data packet is push information, the push information is reconstructed to obtain the corresponding target SMS text. Then, the key features in the target SMS text are extracted and analyzed using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text. Finally, based on the relationship between the abnormal probability and a preset threshold value, a quick decision is made to execute the interception or release operation, which effectively improves the response speed and prevention efficiency of abnormal push information, achieves the purpose of efficient and accurate prevention of abnormal SMS of WAP Push type, and significantly enhances the security of telecommunications network and the reliability of user communication.

[0036] The following section explains each step of the push-in information processing method in conjunction with the specific implementation process.

[0037] In the technical solution provided in step S102 above, the SMS filtering system can receive target short message point-to-point protocol data packets forwarded by the SMS center from the calling number through the aggregation interface, and parse the target short message point-to-point protocol data packets. Based on the parsing results, it determines whether the short message information in the target short message point-to-point protocol data packets is push information. The target short message point-to-point protocol data packet refers to a data packet containing short message information transmitted through the short message information point-to-point protocol, which includes, but is not limited to, the SMS content sent by the calling number, the encoding method, and protocol header information. Push information refers to short message information conforming to the WAP Push specification.

[0038] Specifically, the above-mentioned parsing of the target short message peer-to-peer protocol data packet includes reading and decoding the key fields in the data packet, thereby accurately identifying whether the short message information in the data packet is a push message.

[0039] Optionally, the system can determine whether the short message information in the target short message peer-to-peer protocol data packet is a pushed message in the following manner:

[0040] First, the point-to-point protocol data packets of the target short message sent by the calling number are parsed to obtain the message header and message body.

[0041] A typical short message point-to-point protocol (PSP) data packet consists of a header and a body. The header is a fixed part of each PSP data packet, containing Command Length (4 bytes, indicating the total message length), Command ID (4 bytes, identifying the message type), Command Status (4 bytes, indicating the command execution status), and SequenceNumber (4 bytes, identifying the message order). The body follows the header and includes at least the Extended Service Mode Class (ESM_CLASS) field and the Short Message field. The ESM_CLASS field is an 8-byte field containing several flag bits, as follows:

[0042] Bit 7: Reserved bit, usually 0;

[0043] Bit 6: UDHI (User Data Header Indicator). If this bit is set (i.e., the value is 1), it means that the Short Message field contains a user data header (UDH). The Short Message field usually encapsulates the actual message content and contains a user data header.

[0044] Bit 5: Reserved bit, usually 0;

[0045] Bit 4: Reserved bit, usually 0;

[0046] Bit 3: Reserved bit, usually 0;

[0047] Bit 2: Reserved bit, usually 0;

[0048] Bit 1: Reserved bit, usually 0;

[0049] Bit 0: Reserved bit, usually 0.

[0050] Therefore, when the 6th byte of the Extended Service Mode Category field is set (i.e., the ESM_CLASS field is 0x40), it is determined that the short message field includes the UDH field, and the non-text information of the UDH field within the short message field is further checked to ensure it meets preset conditions. The UDH field is crucial for determining whether the short message information within the target short message peer-to-peer protocol data packet is a pushed message, because the UDH of pushed messages typically contains specific non-text information, such as the Information Element Identifier (IEI), Element Length (IE Length), and Uniform Resource Identifier (URL).

[0051] When the non-text information in the user data header field meets the preset conditions (IEI is 0x50 (target information) and contains a URL), the short message information in the target short message peer-to-peer protocol data packet is determined to be pushed information.

[0052] If the sixth byte of the Extended Service Mode Class field is not set (i.e., the ESM CLASS field is not 0x40), or if the sixth byte of the Extended Service Mode Class field is set but the non-text information in the user header field does not meet the preset conditions, it is determined that the short message information in the target short message point-to-point protocol data packet is not pushed information.

[0053] In other words, if the value of the 6th byte of the Extended Service Mode Category field is 0, it means that the Short Message field does not contain UDH, therefore it can be concluded that the short message information in the target short message peer-to-peer protocol data packet is not a pushed message. Alternatively, if the value of the 6th byte of the Extended Service Mode Category field is 1, but the IEI value in the UDH field is not 0x50 and / or does not contain a URL, it means that the short message information in the target short message peer-to-peer protocol data packet is not a pushed message.

[0054] Optionally, embodiments of this application may further decode the target short message peer-to-peer protocol data packet according to a preset decoding standard, and determine whether the decoded data contains port information conforming to the WAP Push protocol specification. If it does, it indicates that the target short message peer-to-peer protocol data packet contains not only ordinary short message content, but also special WAP Push instructions and data, i.e., the UDH field. Then, based on whether the non-text information in the user data header field meets preset conditions, it is determined whether the short message information in the target short message peer-to-peer protocol data packet is push information. The preset decoding standard can be an industry standard regarding how to decode and parse mobile communication data packets containing WAP Push messages.

[0055] Furthermore, in the technical solution provided in step S104 above, when the short message information in the target short message peer-to-peer protocol data packet is push information, the system can determine the push information in the target short message peer-to-peer protocol data packet based on the parsing result, reconstruct and standardize it to obtain the target SMS text, thereby facilitating subsequent intelligent analysis.

[0056] As an optional implementation, in the technical solution provided in step S104 above, the method may include:

[0057] Step S1041: Determine the control information of the target pushed information based on the parsing results. The control information includes at least: topic, short link, and transcoding identifier.

[0058] Step S1042: Reconstruct the target push information based on the control information to obtain the corresponding target SMS text.

[0059] In the technical solution provided in step S1041 above, the method may include: extracting the Extensible Markup Language (XML) content of the Radio Access Protocol (RAP) binary pushed information from the short message field; parsing the XML content of the RAP binary using a preset parsing library to extract the subject and short link of the pushed information in the target short message PRP data packet; determining whether the calling number in the source address field is consistent with the calling number corresponding to the target short message PRP data packet, and determining the transcoding identifier of the pushed information in the target short message PRP data packet based on the determination result.

[0060] Among them, since WAP Push messages are usually encoded in the WBXML (WAP Binary XML, Wireless Access Protocol Binary Extensible Markup Language) format, the WBXML content in the Short Message field can be extracted, and a decoding library (such as the Libwbxml library) can be used to decode the WBXML content, so as to extract the subject from the text content of the "Indication" or "si" tag, and extract the short link from the "href" attribute of the "Indication" or "si" tag.

[0061] For example, Figure 2 is a schematic diagram of an optional subject extraction according to an embodiment of the present application, as Figure 2 shown. subject=f(MessageBody), where f is a parsing function, and the specific implementation depends on the encoding method and position of the WAP PUSH message. Figure 2 The first byte 0x96 with a gray background represents Subject, 0xE represents the subject length, 0xEA represents UTF8 encoding, and the subsequent 12 bytes represent the four Chinese characters "時來運轉", and each Chinese character occupies 3 bytes, and finally ends with 0x0. Figure 3 is a schematic diagram of an optional short link extraction according to an embodiment of the present application, as Figure 3 shown. ShortURL=g(Message Body), where g is a parsing function, and the specific implementation depends on the link encoding format and position in the message body. Figure 3 The first byte 0x83 with a gray background in the figure identifies the ShortURL field, the subsequent bytes represent the Uniform Resource Identifier URL (http: / / 38.150.25.140 / p / C0cmclT0xL), and finally ends with 0x0.

[0062] In addition, regarding the transcoding identifier, it can be set according to whether the calling number in the source address From field is the same as the calling number corresponding to the target short message point-to-point protocol data packet, so as to characterize whether there is a difference between the actual sender and the claimed sender of the short message. For example, let "F*1" indicate that transcoding exists, and let "F*0" indicate that transcoding does not exist.

[0063] In the technical solution provided in the above step S1042, the system can splice the obtained subject, short link and transcoding identifier to reconstruct the target short message text in a specific format.

[0064] For example, if the subject is "Good Fortune Comes", the short link is "http: / / 38.150.25.140 / p / C0cmclT0xL", and the transcoding identifier is "F*1", then the resulting target SMS text can be "WA*F*1*Good Fortune Comes*http: / / 38.150.25.140 / p / C0cMclT0xL", where WA is used to identify the message as a WAP Push message.

[0065] Furthermore, in the technical solution provided in step S106 above, the system can use an abnormal SMS classification model to analyze the target SMS text and obtain the abnormal probability of the target SMS text. The abnormal SMS classification model is constructed using supervised learning.

[0066] Specifically, the training process for the abnormal SMS classification model may include: acquiring multiple sets of training sample data, wherein each set of training sample data includes: SMS text as training sample and the corresponding category label of the SMS text as the corresponding sample label, and the category label includes: normal label and abnormal label; constructing a neural network model, wherein the neural network model may be a deep learning model, support vector machine, random forest or ensemble learning model, etc., and the neural network model includes at least: feature extraction network and classifier; training the neural network model using multiple sets of training sample data, and updating the model parameters using an optimizer during the training process, calculating the loss function through the backpropagation algorithm, and obtaining the trained abnormal SMS classification model when the loss function meets the preset convergence condition.

[0067] The training sample data mentioned above can be obtained as follows: obtain multiple short message peer-to-peer protocol data packets corresponding to the push information of different category labels; for each short message peer-to-peer protocol data packet, parse the short message peer-to-peer protocol data packet, and determine the SMS text of the corresponding push information based on the obtained parsing results, and perform text enhancement on the SMS text; use the SMS text or enhanced SMS text of the push information in each short message peer-to-peer protocol data packet and the corresponding category label as training samples and sample labels respectively to obtain multiple sets of training sample data.

[0068] The process of parsing the SMS peer-to-peer protocol data packets and obtaining the corresponding pushed SMS text can be specifically referred to in step S104 above, and this embodiment does not impose specific limitations on it. To improve the model's generalization ability, this embodiment also proposes text enhancement of the reconstructed SMS text, such as randomly replacing certain words (especially common words or phrases) in the text to simulate different expressions; using a thesaurus or NLP tools to replace words in the text to create semantically similar but differently expressed SMS texts; changing the sentence structure of the SMS text, such as changing from declarative sentences to interrogative sentences, or adjusting the order of sentence components. Finally, the SMS text or enhanced SMS text pushed into each SMS peer-to-peer protocol data packet and the corresponding category labels are used as training samples and sample labels, respectively, to obtain multiple sets of training sample data.

[0069] In addition to the sample acquisition methods mentioned above, the system can also first train a base model using multiple sets of training sample data consisting of unenhanced SMS text and corresponding category labels; then, use this base model to predict unlabeled SMS text, and use the high-confidence prediction results and the SMS text as new training sample data. By iteratively executing the above steps, the model's performance can be gradually improved.

[0070] In the above embodiments, the abnormal SMS classification model can be loaded into memory. For example, the raw data of the abnormal SMS classification model can be loaded from non-volatile memory into volatile memory so that the processor can run the abnormal SMS classification model. The raw data of the abnormal SMS classification model refers to unprocessed data, which typically includes the parameters and structural data of the abnormal SMS classification model. The structural data can be the calculation relationship based on the parameters, such as the forward propagation calculation relationship between intermediate layers and between neurons. Specifically, the structural data can include the structure-related code of the abnormal SMS classification model, such as code used to perform related calculations between intermediate layers and between neurons.

[0071] In one implementation, a region can be partitioned in memory for loading the abnormal SMS classification model, which may include a structure data storage area and a parameter storage area. The structure data storage area stores structure-related code, and the parameters referenced by it can be pointed to by pointers to the addresses of specific parameters in the parameter storage area. During the training of the abnormal SMS classification model, it may be necessary to frequently update the parameters; in this case, updating the parameter values ​​in the parameter storage area is sufficient.

[0072] Therefore, in the technical solution provided in step S106 above, the system can obtain the anomaly probability of the target SMS text according to the following method:

[0073] The feature extraction network within the abnormal SMS classification model is used to extract features of control information within the target SMS text, resulting in a corresponding control feature vector. This feature extraction network can be a convolutional neural network, a recurrent neural network, or a more advanced Transformer structure to capture control information features at different locations and of varying lengths. The control feature vector is a high-dimensional feature vector containing multi-dimensional representations of the control information, such as word frequency, grammatical structure, topic, presence or absence of short links, and whether transcoding has been performed.

[0074] An abnormal SMS classification model analyzes the control feature vector using a classifier to obtain the probability that the control feature vector belongs to an abnormal category. The classifier can be a fully connected layer, a multilayer perceptron (MLP), or a decision forest ensemble of multiple classifiers. It uses the learned decision boundary to analyze whether the control feature vector belongs to an abnormal category. The abnormal probability is calculated based on the model's matching degree between the learned abnormal control feature vector and the currently input control feature vector. A probability closer to 1 indicates that the SMS text is more likely to be abnormal; a probability closer to 0 indicates that the SMS text is more likely to be normal.

[0075] Finally, in the technical solution provided in step S108 above, the system compares the anomaly probability with a preset threshold value. If the anomaly probability is greater than the preset threshold value, it indicates that the anomaly level of the target SMS text exceeds the predetermined warning line. Therefore, the system can send the interception operation performed on the push information in the target SMS peer-to-peer protocol data packet back to the SMS center through the aggregation interface. The SMS center then performs the interception operation on the push information in the target SMS peer-to-peer protocol data packet to prevent the SMS from reaching the user terminal and prevent potential fraud risks. If the anomaly probability is not greater than the preset threshold value, the system can also send the release operation performed on the push information in the target SMS peer-to-peer protocol data packet back to the SMS center through the aggregation interface. The SMS center then performs the release operation on the push information in the target SMS peer-to-peer protocol data packet to allow the message to reach the user terminal.

[0076] The preset threshold is a manually set standard used to distinguish between normal and abnormal SMS messages. Therefore, this value can be adjusted based on a trade-off between false positives and false negatives, as well as historical data analysis. A higher threshold means that only SMS messages judged highly suspicious by the model will be blocked, reducing the false positive rate but potentially increasing the risk of false negatives; a lower threshold increases the sensitivity of blocking, potentially reducing false negatives but increasing the false positive rate. Therefore, setting a reasonable preset threshold is crucial for the security of telecommunications networks, as it not only effectively prevents fraudulent SMS messages but also minimizes interference with normal SMS services.

[0077] The push message processing method provided in this application, through rapid parsing of SMS peer-to-peer protocol data packets and real-time intelligent analysis, achieves real-time identification and interception of WAP Push messages, significantly shortening the time from receiving the SMS to making a judgment, and enhancing the system's response speed and protection efficiency. Simultaneously, employing large-model technology for deep semantic understanding and pattern recognition, it can self-learn and optimize based on the latest illegal methods and network environment changes, effectively improving the system's accuracy and adaptability in identifying abnormal WAP PUSH type SMS messages, avoiding misclassification of normal SMS messages as fraudulent SMS messages, thereby significantly reducing the false alarm rate and improving user experience and system credibility.

[0078] Example 2

[0079] According to an embodiment of this application, a push-in information processing apparatus for implementing the push-in information processing method in Embodiment 1 is also provided, such as... Figure 4 As shown, the push-in information processing device includes at least: a judgment module 42, a determination module 44, a classification module 46, and a processing module 48, wherein:

[0080] The judgment module 42 is used to parse the target short message point-to-point protocol data packet sent by the calling number, and determine whether the short message information in the target short message point-to-point protocol data packet is a push message based on the parsing result.

[0081] The determination module 44 is used to determine the target SMS text corresponding to the push information in the target SMS point-to-point protocol data packet based on the parsing result when the SMS information in the target SMS point-to-point protocol data packet is push information.

[0082] Classification module 46 is used to analyze the target SMS text using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text.

[0083] The processing module 48 is used to determine the processing operation to be performed on the push information in the target short message point-to-point protocol data packet based on the relationship between the abnormal probability and the preset threshold value. The processing operation includes: interception operation or release operation.

[0084] The functions of each module in the information processing device will be explained below in conjunction with the specific implementation process.

[0085] Optionally, the determination module 42 can determine whether the short message information in the target short message point-to-point protocol data packet is a push message in the following manner:

[0086] First, the point-to-point protocol data packet of the target short message sent by the calling number is parsed to obtain the message header and message body. The message body contains at least the following fields: extended service mode category field and short message field, and the extended service mode category field contains eight bytes.

[0087] When the sixth byte of the Extended Service Mode Category field is set, determine whether the non-text information in the User Header field of the Short Message field meets the preset conditions.

[0088] When the non-text information in the user data header field meets the preset conditions, the short message information in the target short message point-to-point protocol data packet is determined to be the pushed information;

[0089] If the sixth byte of the Extended Service Mode Category field is not set, or if the sixth byte of the Extended Service Mode Category field is set but the non-text information in the User Header field of the Short Message field does not meet the preset conditions, it is determined that the Short Message information in the target Short Message Point-to-Point Protocol data packet is not pushed information.

[0090] Furthermore, when the short message information in the target short message peer-to-peer protocol data packet is pushed information, the determining module 44 can reconstruct and standardize the pushed information in the target short message peer-to-peer protocol data packet based on the parsing results to obtain the corresponding target SMS text, thereby facilitating subsequent intelligent analysis.

[0091] Alternatively, module 44 can obtain the target SMS text as follows:

[0092] Step 1: Determine the control information of the target pushed information based on the parsing results. The control information shall include at least the following: subject, short link, and transcoding identifier.

[0093] Step 2: Reconstruct the target push information based on the control information to obtain the corresponding target SMS text.

[0094] In the technical solution provided in the first step above, the method may include: extracting the Extensible Markup Language (XML) content of the Radio Access Protocol (RAP) binary data pushed into the target short message peer-to-peer protocol data packet from the short message field; parsing the XML content of the RAP binary data packet using a preset parsing library to extract the subject and short link of the pushed information in the target short message peer-to-peer protocol data packet; determining whether the calling number in the source address field matches the calling number corresponding to the target short message peer-to-peer protocol data packet, and determining the transcoding identifier of the pushed information in the target short message peer-to-peer protocol data packet based on the determination result.

[0095] In the technical solution provided in the second step above, the determining module 44 can concatenate the obtained subject, short link and transcoding identifier to reconstruct the target SMS text in a specific format.

[0096] Furthermore, the classification module 46 can analyze the target SMS text using an abnormal SMS classification model to obtain the probability of abnormality of the target SMS text. The abnormal SMS classification model is constructed using supervised learning.

[0097] Specifically, the training process for the abnormal SMS classification model may include: acquiring multiple sets of training sample data, wherein each set of training sample data includes: SMS text as training sample and the corresponding category label of the SMS text as the corresponding sample label, and the category label includes: normal label and abnormal label; constructing a neural network model, wherein the neural network model may be a deep learning model, support vector machine, random forest or ensemble learning model, etc., and the neural network model includes at least: feature extraction network and classifier; training the neural network model using multiple sets of training sample data, and updating the model parameters using an optimizer during the training process, calculating the loss function through the backpropagation algorithm, and obtaining the trained abnormal SMS classification model when the loss function meets the preset convergence condition.

[0098] The training sample data mentioned above can be obtained as follows: obtain multiple short message peer-to-peer protocol data packets corresponding to the push information of different category labels; for each short message peer-to-peer protocol data packet, parse the short message peer-to-peer protocol data packet, and determine the SMS text of the corresponding push information based on the obtained parsing results, and perform text enhancement on the SMS text; use the SMS text or enhanced SMS text of the push information in each short message peer-to-peer protocol data packet and the corresponding category label as training samples and sample labels respectively to obtain multiple sets of training sample data.

[0099] Therefore, the classification module 46 can obtain the abnormal probability of the target SMS text in the following way: use the feature extraction network in the abnormal SMS classification model to extract the control information in the target SMS text to obtain the corresponding control feature vector; use the classifier in the abnormal SMS classification model to analyze the control feature vector to obtain the abnormal probability that the control feature vector belongs to the abnormal category.

[0100] Finally, the processing module 48 compares the anomaly probability with a preset threshold. If the anomaly probability is greater than the preset threshold, it indicates that the anomaly level of the target SMS text exceeds the predetermined warning line. Therefore, the processing module 48 can send the interception operation performed on the push information in the target SMS peer-to-peer protocol data packet back to the SMS center through the aggregation interface. The SMS center will then perform the interception operation on the push information in the target SMS peer-to-peer protocol data packet to prevent the SMS from reaching the user terminal and prevent potential fraud risks. If the anomaly probability is not greater than the preset threshold, the processing module 48 can also send the release operation performed on the push information in the target SMS peer-to-peer protocol data packet back to the SMS center through the aggregation interface. The SMS center will then perform the release operation on the push information in the target SMS peer-to-peer protocol data packet to allow the message to reach the user terminal.

[0101] It should be noted that each module in the push-in information processing device in this application embodiment corresponds one-to-one with each implementation step of the push-in information processing method in embodiment 1. Since embodiment 1 has been described in detail, some details not shown in this embodiment can be referred to embodiment 1, and will not be elaborated further here.

[0102] Example 3

[0103] According to an embodiment of this application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, it implements the push information processing method in embodiment 1.

[0104] According to an embodiment of this application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device containing the non-volatile storage medium executes the push information processing method in Embodiment 1 by running the computer program.

[0105] According to an embodiment of this application, a processor is also provided for running a computer program, wherein the computer program executes the push information processing method in Embodiment 1 during runtime.

[0106] According to an embodiment of this application, an electronic device is also provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the push information processing method of Embodiment 1 through the computer program.

[0107] Specifically, the computer program executes the following steps during runtime: parses the target short message peer-to-peer protocol data packet sent by the calling number, and determines whether the short message information in the target short message peer-to-peer protocol data packet is a push message based on the parsing result; if the short message information in the target short message peer-to-peer protocol data packet is a push message, determines the target SMS text corresponding to the push message in the target short message peer-to-peer protocol data packet based on the parsing result; analyzes the target SMS text using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text; and determines the processing operation to be performed on the push message in the target short message peer-to-peer protocol data packet based on the relationship between the abnormal probability and a preset threshold value, wherein the processing operation includes: interception operation or release operation.

[0108] As an alternative implementation, the above-mentioned electronic device may exist in the form of a mobile terminal, a computer terminal, or a similar computing device. Figure 5 A hardware block diagram of a computer terminal for implementing a push-in information processing method is shown. Figure 5 As shown, the computer terminal 50 may include one or more processors 502 (shown as 502a, 502b, ..., 502n in the figure) 502 (processor 502 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 504 for storing data, and a transmission device 506 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 5 The structure shown is for illustrative purposes only and does not limit the structure of the computer terminal described above. For example, computer terminal 50 may also include... Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown.

[0109] It should be noted that the aforementioned one or more processors 502 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 50. As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0110] The memory 504 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the push information processing method in this embodiment. The processor 502 executes various functional applications and data processing by running the software programs and modules stored in the memory 504, thereby implementing the above-mentioned application vulnerability detection method. The memory 504 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 504 may further include memory remotely located relative to the processor 502, and these remote memories can be connected to the computer terminal 50 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0111] The transmission device 506 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 50. In one example, the transmission device 506 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 506 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0112] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 50.

[0113] The sequence numbers of the above embodiments are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0114] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0116] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0119] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for processing pushed information, characterized in that, include: The target short message point-to-point protocol data packet sent by the calling number is parsed, and the short message information in the target short message point-to-point protocol data packet is determined based on the parsing result; When the short message information in the target short message peer-to-peer protocol data packet is push information, the target SMS text corresponding to the push information in the target short message peer-to-peer protocol data packet is determined according to the parsing result; The abnormal SMS text is analyzed using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text; Based on the relationship between the anomaly probability and the preset threshold value, the processing operation to be performed on the push information in the target short message peer-to-peer protocol data packet is determined, wherein the processing operation includes: interception operation or release operation.

2. The method according to claim 1, characterized in that, The target short message peer-to-peer protocol data packet sent by the calling number is parsed, and based on the parsing result, it is determined whether the short message information in the target short message peer-to-peer protocol data packet is a push message, including: The point-to-point protocol data packet of the target short message information sent by the calling number is parsed to obtain the message header and message body. The message body contains at least the following fields: extended service mode category field and short message field. The extended service mode category field contains eight bytes. When the sixth byte of the extended service mode category field is set, it is determined that the non-text information in the user data header field of the short message field meets the preset conditions. When the non-text information in the user data header field meets the preset conditions, the short message information in the target short message peer-to-peer protocol data packet is determined to be push information; If the sixth byte of the Extended Service Mode Category field is not set, or if the sixth byte of the Extended Service Mode Category field is set but the non-text information in the user data header field of the SMS field does not meet the preset conditions, it is determined that the SMS information in the target SMS peer-to-peer protocol data packet is not push information.

3. The method according to claim 2, characterized in that, Based on the parsing results, the target SMS text corresponding to the pushed information within the target short message peer-to-peer protocol data packet is determined, including: Based on the parsing results, control information for the push-in information within the target short message peer-to-peer protocol data packet is determined, wherein the control information includes at least: subject, short link, and transcoding identifier; The push information in the target short message peer-to-peer protocol data packet is reconstructed based on the control information to obtain the target SMS text.

4. The method according to claim 3, characterized in that, The plurality of fields also includes: a source address field, wherein the control information for determining the push information within the target short message peer-to-peer protocol data packet based on the parsing result includes: Extract the Extensible Markup Language (XML) content of the wireless access protocol binary from the push information in the target short message peer-to-peer protocol data packet from the short message field; The Extensible Markup Language (XML) content of the wireless access protocol binary is parsed using a preset parsing library to extract the subject and short link of the pushed information in the target short message peer-to-peer protocol data packet. Determine whether the calling number in the source address field matches the calling number corresponding to the target short message peer-to-peer protocol data packet, and determine the transcoding identifier of the pushed information in the target short message peer-to-peer protocol data packet based on the determination result.

5. The method according to claim 1, characterized in that, The training process of the abnormal SMS classification model includes: Multiple sets of training sample data are obtained, wherein each set of training sample data includes: SMS text as training sample, category label corresponding to the SMS text as corresponding sample label, and the category label includes: normal label and abnormal label; Construct a neural network model, wherein the neural network model includes at least: a feature extraction network and a classifier; The neural network model is trained using the multiple sets of training sample data. During the training process, the model parameters are updated using an optimizer, and the loss function is calculated using the backpropagation algorithm. When the loss function satisfies the preset convergence condition, the abnormal SMS classification model that has been trained is obtained.

6. The method according to claim 5, characterized in that, Obtain multiple sets of training sample data, including: Retrieve multiple short message information point-to-point protocol data packets corresponding to the push information of different categories of tags; For each of the short message peer-to-peer protocol data packets, the short message peer-to-peer protocol data packets are parsed, and the corresponding push message text is determined based on the obtained parsing results. The text of the push message is then enhanced. The multiple sets of training sample data are obtained by using the SMS text or enhanced SMS text pushed into each of the short message information point-to-point protocol data packets and the corresponding category labels as training samples and sample labels, respectively.

7. The method according to claim 5, characterized in that, The target SMS text is analyzed using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text, including: The feature extraction network within the abnormal SMS classification model is used to extract features from the control information in the target SMS text to obtain the corresponding control feature vector. The control feature vector is analyzed using the classifier in the abnormal SMS classification model to obtain the probability that the control feature vector belongs to an abnormal category.

8. An information processing device for pushing information, characterized in that, include: The judgment module is used to parse the target short message point-to-point protocol data packet sent by the calling number, and determine whether the short message information in the target short message point-to-point protocol data packet is a push message based on the parsing result. The determination module is used to determine the target SMS text corresponding to the push information in the target SMS peer-to-peer protocol data packet based on the parsing result when the SMS information in the target SMS peer-to-peer protocol data packet is push information. The classification module is used to analyze the target SMS text using an abnormal SMS classification model to obtain the abnormal probability of the target SMS text. The processing module is used to determine the processing operation to be performed on the push information in the target short message peer-to-peer protocol data packet based on the relationship between the anomaly probability and the preset threshold value, wherein the processing operation includes: interception operation or release operation.

9. A computer program product, characterized in that, include: A computer program, wherein when executed by a processor, the computer program implements the push information processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the push information processing method according to any one of claims 1 to 7 through the computer program.

Images