A mobile phone short message based behavior analysis method and device

Abstract

This invention presents a behavior analysis method based on mobile phone text messages, including: extracting text message information; manually labeling the extracted text message data and categorizing it according to different content; dividing the data into training, validation, and test sets using stratified sampling in an 8:1:1 ratio; processing the data through keyword comparison, regular expressions, behavioral intent recognition, and key element extraction to obtain analysis results; and integrating and aggregating the analysis results to output a characterization analysis of relevant user behaviors. Building upon traditional content keyword comparison and regular expression analysis, this method utilizes artificial intelligence text semantic analysis technology and related methods to comprehensively and deeply analyze text message content from massive datasets, eliminating the need for manual sifting and statistics. It characterizes target user text message behavior events, providing users with an efficient technical means to discover clues, secure evidence, and conduct analysis and judgment in a timely manner.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a method and apparatus for behavioral analysis based on mobile phone text messages. Background Technology

[0002] With the development of the internet and technology, smartphones have increasingly larger storage spaces, and the amount of information stored on them is also growing. Information extracted from these phones, such as text messages, call logs, and chat logs, plays a crucial role in solving cases.

[0003] Currently, when grassroots units conduct investigations and collect evidence from mobile phones, they use mobile phone forensics devices to extract text message information and recover deleted messages to reconstruct the mobile phone user's text message behavior events as much as possible. However, existing mobile phone forensics products lack in-depth analysis methods for text message content. Extracted messages are generally displayed in chronological order of sending or receiving, and financial transaction records or identity / account information, such as mobile phone numbers and ID card numbers, are extracted through regular expressions or keyword comparison.

[0004] As smartphone storage space gradually increases, text messages are generally stored on the phone. Over time, the amount of text messages accumulates. After being extracted by traditional mobile phone forensics equipment, the content of the text messages is not analyzed in depth. Frontline staff have to browse through each message one by one, which makes it difficult to find valuable clues in a timely manner. This leads to problems such as difficulty in finding clues, untimely investigation and evidence collection, and low efficiency in case handling. Summary of the Invention

[0005] This invention proposes a method and apparatus for behavior analysis based on mobile phone text messages.

[0006] In one aspect, the present invention proposes a behavior analysis method based on mobile phone text messages, comprising the following steps:

[0007] S1: Extract SMS messages from mobile phones;

[0008] S2: The SMS messages extracted in S1 are analyzed by keyword comparison, rule comparison, and SMS behavior analysis model to obtain the analysis results;

[0009] S3: Merge and aggregate the analysis results obtained in S2 to obtain the merged and aggregated results, and output the SMS behavior analysis and characterization results.

[0010] The SMS behavior analysis model includes: behavioral intent identification and key element extraction.

[0011] Based on the above technical solutions, and building upon traditional content keyword comparison and regular expression analysis, artificial intelligence text semantic analysis technology and related methods are used to comprehensively and deeply analyze SMS content even in the face of massive amounts of data. This provides efficient technical means for grassroots staff to discover clues, secure evidence, and conduct analysis and judgment in a timely manner.

[0012] In a specific embodiment, the steps for behavioral intent recognition are as follows:

[0013] S201: Manually label SMS data and categorize them according to different SMS content;

[0014] S202: Using stratified sampling, the data is divided into training, validation and test sets in an 8:1:1 ratio.

[0015] S203: Obtain the vocabulary by deduplicating the training set, i.e., randomly initialize the mapping matrix W according to the size of the vocabulary. mn , where m is the size of the vocabulary and n is the dimension of the word vectors. This matrix is ​​optimized during the training process.

[0016] S204: By querying W mn The vector representation W of the training samples is obtained. i , where i represents the i-th sample.

[0017] S205: To W i Perform a convolution operation to obtain the convolution result f. cnn (w i ;θ cnn );

[0018] S206: For f cnn (w i ;θ cnn Global feature extraction is performed on the convolution results of ).

[0019] In a specific embodiment, the key element extraction steps are as follows:

[0020] S211: Manually label SMS data, marking the starting positions of content such as time, location, amount, and application name;

[0021] S212: Using stratified sampling, the data is divided into training, validation and test sets in an 8:1:1 ratio.

[0022] S213: Obtain the vocabulary by deduplicating the training set, i.e., randomly initialize the mapping matrix W according to the size of the vocabulary. ab , where a is the size of the vocabulary and b is the dimension of the word vectors. This matrix is ​​optimized during the training process.

[0023] S214: By querying W ab The vector representation W of the training samples is obtained. I , where I represents the I-th sample;

[0024] S215: To W I Perform RNN operations to obtain the feature extraction result f. rab (w I ;θ rab ).

[0025] In a preferred embodiment, for w i Perform a convolution operation to obtain the convolution result f. cnn (w i ;θ cnn The specific convolutional network structure is not limited; it can be any size and number of convolutional kernels. Pooling and other operations can be combined, and the extraction effect depends on the actual sample features. Taking max pooling to extract global features as an example, the feature representation x of the SMS text content is obtained. p :

[0026] x p =f GMP (f cnn (w i ;θ cnn ))∈R D

[0027] Where θ cnn This represents the model parameters, where D is the defined feature dimension;

[0028] Then x p The soft max layer is applied to obtain the category label L with the maximum score, where L = arg max soft max(x) p ).

[0029] In a preferred embodiment, for W I Perform RNN operations to obtain the feature extraction result f. rab (w I ;θ rab Specifically, bidirectional feature extraction is employed, the extracted results are concatenated, and the feature extraction results are then soft-maxed to obtain the category label Q with the maximum score, where Q = arg max soft max(f rab (w I ;θ rab )), where: θ rab Indicates model parameters.

[0030] In a specific embodiment, the analysis results in S3 are fused and aggregated. The analysis results obtained from keyword comparison, rule comparison, and SMS behavior analysis model analysis of the mobile phone SMS information in S2 are fused and aggregated. The specific steps include: obtaining relevant SMS messages on the mobile phone through behavioral intent recognition; extracting key information from relevant SMS messages and key elements of reverse behavior; and characterizing and analyzing all relevant user behaviors.

[0031] Through the above technical means, automated analysis of smartphone SMS content behavior has been achieved, effectively improving the efficiency of analysis and judgment work for grassroots staff, and enhancing the accuracy of analysis and judgment by continuously improving the analysis model.

[0032] In specific embodiments, it may also include S4 model updates. After the mobile phone forensics device extracts SMS messages and aggregates them through the background system, it continuously accumulates various types of mobile phone SMS data, improves the sources and content types, and continuously trains and improves the SMS behavior analysis model through manual annotation and automatic machine annotation, thereby improving the accuracy of SMS content behavior analysis.

[0033] According to a second aspect of the invention, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a computer processor, performs the methods described above.

[0034] According to a third aspect of the present invention, a behavior analysis system based on mobile phone text messages is proposed, comprising:

[0035] Extraction Unit: Configured for extracting SMS information from mobile phones;

[0036] Analysis unit: configured to perform keyword comparison, rule comparison, behavioral intent recognition, and key element extraction on the mobile phone SMS information to obtain corresponding analysis results;

[0037] Output unit: Configured to fuse and aggregate the analysis results, and output the SMS behavior analysis profile.

[0038] In a preferred embodiment, SMS behavior analysis specifically includes the following steps:

[0039] S201: Manually label SMS data and categorize them according to different SMS content;

[0040] S202: Using stratified sampling, the data is divided into training, validation and test sets in an 8:1:1 ratio.

[0041] S203: The training set is deduplicated to obtain a vocabulary, i.e., the mapping matrix W is randomly initialized according to the size of the vocabulary. mn , where m is the size of the vocabulary and n is the dimension of the word vectors;

[0042] S204: By querying W mn The vector representation W of the training samples is obtained. i , where i represents the i-th sample;

[0043] S205: To W i Perform a convolution operation to obtain the convolution result f. cnn (w i ;θ cnn );

[0044] S206: For the convolution result f cnn (w i ;θ cnn Global feature extraction is performed, specifically by using max pooling to extract global features, resulting in the feature representation x of the SMS text content. p :

[0045] x p =f GMP (f cnn (w i ;θ cnn ))∈R D

[0046] Where θ cnn This represents the model parameters, where D is the defined feature dimension;

[0047] Then x p The soft max layer is applied to obtain the category label L with the highest score, where L is calculated using the following formula:

[0048] L = arg max soft max(x) p ).

[0049] In a preferred embodiment, the key element extraction specifically includes the following steps:

[0050] S211: Manually label SMS data, including the start and end of the time, location, amount, and application name content.

[0051] S212: Using stratified sampling, the data is divided into training, validation and test sets in an 8:1:1 ratio.

[0052] S213: Obtain the vocabulary by deduplicating the training set, i.e., randomly initialize the mapping matrix W according to the size of the vocabulary. ab , where a is the size of the vocabulary and b is the dimension of the word vector;

[0053] S214: By querying W ab The vector representation W of the training samples is obtained. I, where I represents the I-th sample;

[0054] S215: To W I Perform RNN operations to obtain the feature extraction result f. rab (w I ;θ rab Specifically, bidirectional feature extraction is employed, the extracted results are concatenated, and the feature extraction results are then soft-maxed to obtain the category label Q with the maximum score, where Q = argmax softmax(f rab (w I ;θ rab )), where θ rab Indicates model parameters.

[0055] In a preferred embodiment, an iterative update unit is further included: configured to manually process and train the SMS data collected by the background system and feed back the results to iteratively optimize the SMS behavior analysis model.

[0056] This invention, tailored to the needs of practical application scenarios, constructs a text message behavior analysis model. Building upon traditional content keyword comparison and regular expression analysis, it utilizes artificial intelligence text semantic analysis technology and related methods to comprehensively and deeply analyze text message content from massive amounts of data. This eliminates the need for manual sifting and statistics, characterizing target SMS behavior events. Furthermore, it can be integrated into products such as mobile phone evidence collection and mobile phone data analysis. The analysis boasts high accuracy and speed, making it suitable for rapid analysis and mining of target SMS content information in scenarios such as on-site and laboratory evidence collection. This characterization of target SMS behavior events provides fundamental and crucial data support for case investigation. Attached Figure Description

[0057] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Other features, objects, and advantages of this application will become more apparent from reading the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0058] Figure 1 This is an exemplary system architecture diagram to which this application can be applied;

[0059] Figures 2(a) to (b) are flowcharts of a behavior analysis method based on mobile phone text messages according to an embodiment of this application;

[0060] Figures 3(a) to (c) are flowcharts of a behavior analysis method based on mobile phone text messages according to a specific embodiment of this application;

[0061] Figure 4 This is a framework diagram of a behavior analysis system based on mobile phone text messages, according to one embodiment of this application.

[0062] Figure 5 This is a schematic diagram of the structure of a computer system suitable for implementing the electronic devices of the present application embodiments. Detailed Implementation

[0063] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0064] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0065] Figure 1 An exemplary system architecture 100 for applying a behavior analysis method based on mobile phone text messages according to embodiments of this application is shown.

[0066] like Figure 1 As shown, system architecture 100 may include a data server 101, a network 102, and a main server 103. Network 102 serves as the medium for providing a communication link between data server 101 and main server 103. Network 102 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0067] The main server 103 can be a server that provides various services, such as a data processing server that processes the information uploaded by the data server 101. The data processing server can perform behavioral analysis on the mobile phone SMS dataset and store the processing results in a matching result database.

[0068] It should be noted that the behavior analysis method based on mobile phone text messages provided in this application embodiment is generally executed by the main server 103, and correspondingly, the device for behavior analysis of mobile phone text message data is generally set in the main server 103.

[0069] It should be noted that data servers and master servers can be either hardware or software. When they are hardware, they can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When they are software, they can be implemented as multiple software programs or software modules (e.g., software programs or software modules used to provide distributed services), or as a single software program or software module.

[0070] It should be understood that Figure 1 The number of data servers, networks, and main servers shown is merely illustrative. Depending on implementation needs, there can be any number of terminal devices, networks, and servers.

[0071] According to an embodiment of this application, a behavior analysis method based on mobile phone text messages is provided. Figures 2(a) and (b) show flowcharts of such a method. As shown in Figures 2(a) and (b), the method includes the following steps:

[0072] S1: Extract SMS messages from mobile phones;

[0073] S2: The SMS messages extracted in S1 are analyzed by keyword comparison, rule comparison, and SMS behavior analysis model to obtain the analysis results;

[0074] S3: Merge and aggregate the analysis results obtained in S2 to obtain the merged and aggregated results, and output the SMS behavior analysis and characterization results.

[0075] The SMS behavior analysis model includes: behavioral intent identification and key element extraction.

[0076] In a specific embodiment, the behavioral intent recognition process includes the following steps:

[0077] S201: Manually label SMS data and categorize them according to different SMS content;

[0078] S202: Using stratified sampling, the data is divided into training, validation and test sets in an 8:1:1 ratio.

[0079] S203: Obtain the vocabulary by deduplicating the training set, i.e., randomly initialize the mapping matrix W according to the size of the vocabulary. mn , where m is the size of the vocabulary and n is the dimension of the word vectors. This matrix is ​​optimized during the training process.

[0080] S204: By querying W mn The vector representation W of the training samples is obtained. i , where i represents the i-th sample.

[0081] S205: To W i Perform a convolution operation to obtain the convolution result f. cnn (w i ;θ cnn );

[0082] S206: For f cnn (w i ;θ cnn Global feature extraction is performed on the convolution results of ).

[0083] In a preferred embodiment, for w i Perform a convolution operation to obtain the convolution result f. cnn (w i ;θ cnn The specific convolutional network structure is not limited; it can be any size and number of convolutional kernels. Pooling and other operations can be combined, and the extraction effect depends on the actual sample features. Taking max pooling to extract global features as an example, the feature representation x of the SMS text content is obtained. p :

[0084] x p =f GMP (f cnn (w i ;θ cnn ))∈R D

[0085] Where θ cnn This represents the model parameters, where D is the defined feature dimension;

[0086] Then x p The category label L with the maximum score is obtained by applying a softmax layer, where L = argmaxsoftmax(x) p ).

[0087] In practical implementation, the specific steps for extracting key elements are as follows:

[0088] S211: Manually label SMS data, marking the starting positions of content such as time, location, amount, and application name;

[0089] S212: Using stratified sampling, the data is divided into training, validation and test sets in an 8:1:1 ratio.

[0090] S213: Obtain the vocabulary by deduplicating the training set, i.e., randomly initialize the mapping matrix W according to the size of the vocabulary. ab , where a is the size of the vocabulary and b is the dimension of the word vectors. This matrix is ​​optimized during the training process.

[0091] S214: By querying W ab The vector representation W of the training samples is obtained. I , where I represents the I-th sample;

[0092] S215: To W I Perform RNN operations to obtain the feature extraction result f. rab (w I ;θ rab ).

[0093] In the preferred implementation, for W I Perform RNN operations to obtain the feature extraction result f. rab (w I ;θ rab Specifically, bidirectional feature extraction is employed, the extracted results are concatenated, and the feature extraction results are then softmaxed to obtain the category label Q with the maximum score, where Q = argmaxsoftmax(f rab (w I ;θ rab )), where: θ rab Indicates model parameters.

[0094] Based on the above technical solutions, and building upon traditional content keyword comparison and regular expression analysis, artificial intelligence text semantic analysis technology and related methods are used to comprehensively and deeply analyze SMS content even in the face of massive amounts of data. This provides efficient technical means for grassroots staff to discover clues, secure evidence, and conduct analysis and judgment in a timely manner.

[0095] Figures 3(a) to (c) show flowcharts of a behavior analysis method based on mobile phone text messages according to a specific embodiment of the present invention. The method specifically includes the following steps:

[0096] As shown in Figure 3(a), after the mobile phone forensics device backs up and extracts the SMS messages, it processes them through keyword comparison, regular expressions, and by calling the SMS behavior analysis model of this invention (behavioral intent recognition and key element extraction). Combining keyword comparison and rule comparison methods, it comprehensively and automatically mines out sensitive information, key identity information (such as mobile phone number and ID number), and behavioral events (such as fund transfer, application registration, login, payment, etc.) in the SMS messages, comprehensively characterizing and analyzing the SMS content, and providing basic key data support for grassroots personnel.

[0097] In a specific embodiment, as shown in Figure 3(b), the purpose of behavioral intent recognition is to classify the SMS content and initially identify the behavioral category of the SMS content, such as registration, login, shopping, payment, etc.

[0098] The specific steps are as follows:

[0099] The SMS data was manually labeled and categorized according to different SMS content, such as registration, login, shopping, and payment. Then, using stratified sampling, the data was divided into training, validation, and test sets in an 8:1:1 ratio.

[0100] The vocabulary is obtained by deduplicating the training set. The mapping matrix W is then randomly initialized based on the size of the vocabulary. mn , where m is the size of the vocabulary and n is the dimension of the word vectors. This matrix is ​​optimized during the training process.

[0101] By querying W mn The vector representation w of the training samples is obtained. i , where i represents the i-th sample.

[0102] For w i Perform a convolution operation to obtain the convolution result f. cnn (w i ;θ cnn The specific convolutional network structure is not limited; it can be any size and number of convolutional kernels, pooling, and other operations combined. The extraction effect is related to the actual sample features.

[0103] Convolution results f for different (kernels) cnn (w i ;θ cnn Global feature extraction is performed, and the extraction method is not limited; it can be feature concatenation, pooling, or other extraction methods. This scheme uses max pooling to extract global features as an example to obtain the feature representation x of the SMS text content. p :

[0104] x p =f GMP (f cnn (w i ;θ cnn ))∈R D

[0105] Where: θ cnn This represents the model parameters, where D is the defined feature dimension.

[0106] Finally, x p Apply a softmax layer to obtain the category label with the highest score.

[0107] L = argmaxsoftmax(x p )

[0108] In a specific embodiment, as shown in Figure 3(c), the purpose of key element extraction is to extract key information from the SMS content, such as time, location, amount, application name, etc.

[0109] The specific steps are as follows:

[0110] The SMS data is manually annotated, with tags indicating the starting positions of information such as time, location, amount, and application name.

[0111] The data was divided into training, validation and test sets in an 8:1:1 ratio using stratified sampling.

[0112] The vocabulary is obtained by deduplicating the training set. The mapping matrix W is then randomly initialized based on the size of the vocabulary. ab, where a is the size of the vocabulary and b is the dimension of the word vectors. This matrix is ​​optimized during the training process.

[0113] By querying W ab The vector representation w of the training samples is obtained. I , where I represents the I-th sample.

[0114] For w I Perform RNN operations to obtain the feature extraction result f. rab (w I ;θ rab The specific recurrent neural network structure is not limited; it can be used for unidirectional or bidirectional feature extraction, and the extraction effect depends on the actual sample features. If bidirectional feature extraction is used, the extraction results can be concatenated.

[0115] The category label with the highest score is obtained by applying softmax to the feature extraction results.

[0116] Q = argmaxsoftmax(f rab (w I ;θ rab ))

[0117] Where: θ rnn Indicates model parameters.

[0118] In a preferred embodiment, it may also include S4 model update (not shown in the figure). After the mobile phone forensics device extracts the SMS messages and collects them through the background system, it continuously accumulates various types of mobile phone SMS data, improves the sources and content types, and continuously trains and improves the SMS behavior analysis model through manual annotation and automatic machine annotation, thereby improving the accuracy of SMS content behavior analysis.

[0119] Figure 4 A behavior analysis system based on mobile phone text messages according to another embodiment of the present invention is shown. The system specifically includes an extraction unit 401, an analysis unit 402, an output unit 403, and an iterative update unit 404.

[0120] In a specific embodiment, the extraction unit is configured to extract mobile phone SMS information;

[0121] Analysis unit: configured to perform keyword comparison, rule comparison, behavioral intent recognition, and key element extraction on the mobile phone SMS information to obtain corresponding analysis results;

[0122] Output unit: Configured to fuse and aggregate the analysis results, and output the SMS behavior analysis profile.

[0123] In a preferred embodiment, the key element extraction specifically includes the following steps:

[0124] S201: Manually label SMS data and categorize them according to different SMS content;

[0125] S202: Using stratified sampling, the data is divided into training, validation and test sets in an 8:1:1 ratio.

[0126] S203: Obtain the vocabulary by deduplicating the training set, i.e., randomly initialize the mapping matrix W according to the size of the vocabulary. mn , where m is the size of the vocabulary and n is the dimension of the word vectors. This matrix is ​​optimized during the training process.

[0127] S204: By querying W mn The vector representation W of the training samples is obtained. i , where i represents the i-th sample.

[0128] S205: To W i Perform a convolution operation to obtain the convolution result f. cnn (w i ;θ cnn );

[0129] S206: For f cnn (w i ;θ cnn Global feature extraction is performed on the convolution results of ).

[0130] In a preferred embodiment, for w i Perform a convolution operation to obtain the convolution result f. cnn (w i ;θ cnn The specific convolutional network structure is not limited; it can be any size and number of convolutional kernels. Pooling and other operations can be combined, and the extraction effect depends on the actual sample features. Taking max pooling to extract global features as an example, the feature representation x of the SMS text content is obtained. p :

[0131] x p =f GMP (f cnn (w i ;θ cnn ))∈R D

[0132] Where θ cnn This represents the model parameters, where D is the defined feature dimension;

[0133] Then x p The soft max layer is applied to obtain the category label L with the maximum score, where L = arg max soft max(x) p ).

[0134] In a preferred embodiment, the key element extraction specifically includes the following steps:

[0135] S211: Manually label SMS data, including the start and end of the time, location, amount, and application name content.

[0136] S212: Using stratified sampling, the data is divided into training, validation and test sets in an 8:1:1 ratio.

[0137] S213: Obtain the vocabulary by deduplicating the training set, i.e., randomly initialize the mapping matrix W according to the size of the vocabulary. ab , where a is the size of the vocabulary and b is the dimension of the word vector;

[0138] S214: By querying W ab The vector representation W of the training samples is obtained. I , where I represents the I-th sample;

[0139] S215: To W I Perform RNN operations to obtain the feature extraction result f. rab (w I ;θ rab Specifically, bidirectional feature extraction is employed, the extracted results are concatenated, and the feature extraction results are then soft-maxed to obtain the category label Q with the maximum score, where Q = argmax softmax(f rab (w I ;θ rab )), where θ rab Indicates model parameters.

[0140] In a preferred embodiment, the analysis results are fused and aggregated, specifically including: performing keyword comparison, rule comparison, and SMS behavior analysis model analysis on the mobile phone SMS information in S2, and fusing and aggregating the obtained analysis results. Specific steps include: obtaining relevant SMS messages on the mobile phone through behavioral intent recognition; extracting key information from relevant SMS messages and key elements of reverse behavior; and characterizing and analyzing all relevant user behaviors.

[0141] In a preferred embodiment, an iterative update unit is further included: configured to manually process and train the SMS data collected by the background system and feed back the results to iteratively optimize the SMS behavior analysis model.

[0142] Embodiments of the present invention also relate to a computer-readable storage medium storing a computer program that, when executed by a computer processor, performs the methods described above. The computer program includes program code for performing the methods shown in the flowchart. It should be noted that the computer-readable medium of this application may be a computer-readable signal medium, a computer-readable medium, or any combination of the two.

[0143] The following is for reference. Figure 5 It shows a schematic diagram of the structure of a computer system 500 suitable for implementing electronic devices according to embodiments of the present application. Figure 5 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0144] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 502 or programs loaded from storage section 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the system 500. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0145] The following components are connected to I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a liquid crystal display (LCD) and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card and a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to I / O interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 510 as needed so that computer programs read from it can be installed into storage section 508 as needed.

[0146] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by central processing unit (CPU) 501, it performs the functions defined in the methods of this application.

[0147] It should be noted that the computer-readable storage medium described in this application can be a computer-readable signal medium, a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable storage medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable storage medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0148] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0149] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0150] The units described in the embodiments of this application can be implemented in software or hardware. The described units can also be located in a processor; for example, a processor can be described as including a first determining unit, a second determining unit, a generating unit, a first extracting unit, and a first storing unit. The names of these units do not necessarily limit the specific unit; for example, the first determining unit can also be described as "a unit that determines whether a preset event information list contains newly added event information."

[0151] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: extract mobile phone SMS information; manually label the extracted SMS data and classify it into different categories according to different SMS content; divide the data into training set, validation set, and test set in an 8:1:1 ratio using stratified sampling; process the data through keyword comparison, regular expressions, behavioral intent recognition, and key element extraction to obtain analysis results; and fuse and aggregate the analysis results to output a characterization analysis of the user's relevant behaviors.

[0152] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A behavior analysis method based on mobile phone text messages, characterized in that, Includes the following steps: S1: Extract SMS messages from mobile phones; S2: Perform keyword comparison, rule comparison, and SMS behavior analysis model analysis on the mobile phone SMS information to obtain corresponding analysis results; S3: Merge and aggregate the analysis results to obtain the merged result, and output the SMS behavior analysis and characterization result; The SMS behavior analysis model includes: behavior intent identification and key element extraction. The specific steps of behavior intent identification include: manually labeling SMS data, classifying it into different categories based on different SMS content, dividing the data into training, validation, and test sets using stratified sampling in an 8:1:1 ratio, deduplicating the training set to obtain a vocabulary, and randomly initializing a mapping matrix based on the size of the vocabulary. Where m is the size of the vocabulary and n is the dimension of the word vectors, obtained through querying. This yields the vector representation of the training samples. ,in Indicates the first One sample, for Perform a convolution operation to obtain the convolution result. For the convolution result Global feature extraction is performed; the specific steps for key element extraction include: manually labeling SMS data, the objects of which include: the starting position of time, location, amount, and application name content; dividing the data into training, validation, and test sets in an 8:1:1 ratio using stratified sampling; obtaining a vocabulary by deduplicating the training set; and randomly initializing a mapping matrix based on the size of the vocabulary. ,in For the size of the vocabulary list, The dimension of the word vector is determined by the query. To obtain the vector representation of the training samples ,in Indicates the first One sample, for Perform RNN operations to obtain feature extraction results. .

2. The behavior analysis method based on mobile phone text messages according to claim 1, characterized in that, The different Global feature extraction is performed on the convolution results, specifically: max pooling is used to extract global features to obtain the feature representation of the SMS text content. : ； in This represents the model parameters, where D is the defined feature dimension; Then conduct The layer effect yields the category label L with the highest score, where L is calculated using the following formula: 。 3. The behavior analysis method based on mobile phone text messages according to claim 2, characterized in that, The pair Perform RNN operations to obtain feature extraction results. Specifically, it involves: employing bidirectional feature extraction, concatenating the extracted results, and then... The category label Q with the highest score, ,in Indicates model parameters.

4. The behavior analysis method based on mobile phone text messages according to claim 1, characterized in that, The process of integrating and aggregating the analysis results specifically includes: performing keyword comparison, rule comparison, and SMS behavior analysis model analysis on the mobile phone SMS information in S2, and then integrating and aggregating the analysis results. The specific steps include: obtaining relevant SMS messages on the mobile phone through behavioral intent recognition; extracting key information from relevant SMS messages and key elements of reverse behavior; and characterizing and analyzing all relevant user behaviors.

5. The behavior analysis method based on mobile phone text messages according to claim 1, characterized in that, It also includes S4 model updates, where SMS messages extracted by mobile phone forensics devices are aggregated through the backend system, labeled, and used to train the SMS behavior analysis model.

6. A computer-readable storage medium having one or more computer programs stored thereon, characterized in that, When the one or more computer programs are executed by a computer processor, they perform the method according to any one of claims 1 to 5.

7. A behavior analysis system based on mobile phone text messages, used to perform the method as described in any one of claims 1 to 5, characterized in that, The system includes: Extraction Unit: Configured for extracting SMS information from mobile phones; Analysis Unit: Configured to perform keyword comparison, rule comparison, behavioral intent recognition, and key element extraction on the mobile phone SMS messages to obtain corresponding analysis results; the behavioral intent recognition includes: manually labeling the SMS data, classifying them into different categories according to different SMS content, dividing the data into training, validation, and test sets in an 8:1:1 ratio using stratified sampling, deduplicating the training set to obtain a vocabulary, i.e., randomly initializing a mapping matrix according to the size of the vocabulary, where m is the size of the vocabulary and n is the dimension of the word vectors, obtaining the vector representation of the training samples through querying, where represents the i-th sample, and performing convolution on the vector representation. The convolution operation is performed to obtain the convolution result, and global feature extraction is performed on the convolution result. The specific steps of key element extraction include: manually annotating the SMS data, the objects of which include: the starting position of the content of time, location, amount, and application name; dividing the data into training set, validation set and test set in an 8:1:1 ratio using stratified sampling; obtaining a vocabulary by deduplication of the training set, i.e., randomly initializing the mapping matrix according to the size of the vocabulary, where is the size of the vocabulary and is the dimension of the word vector; obtaining the vector representation of the training sample by querying, where represents the i-th sample; and performing RNN operation on the sample to obtain the feature extraction result. Output unit: Configured to fuse and aggregate the analysis results, and output the SMS behavior analysis profile.

8. The behavior analysis system based on mobile phone text messages according to claim 7, characterized in that, The SMS behavior analysis also includes the following steps: For the convolution result Global feature extraction is performed, specifically by using max pooling to extract global features and obtain the feature representation of the SMS text content. : ； in This represents the model parameters, where D is the defined feature dimension; Then conduct The layer effect yields the category label L with the highest score, where L is calculated using the following formula: 。 9. The behavior analysis system based on mobile phone text messages according to claim 7, characterized in that, The extraction of key elements includes: Manually label the SMS data, including the time, location, amount, and the beginning and end of the application name content. The data was divided into training, validation and test sets in an 8:1:1 ratio using stratified sampling. The vocabulary is obtained by deduplicating the training set, i.e., the mapping matrix is ​​randomly initialized according to the size of the vocabulary. ,in For the size of the vocabulary list, The dimension of the word vector; By query To obtain the vector representation of the training samples ,in Indicates the first One sample; right Perform RNN operations to obtain feature extraction results. Specifically, bidirectional feature extraction is employed, and the extracted results are concatenated and processed. The category label Q with the highest score, ,in Indicates model parameters.

10. The behavior analysis system based on mobile phone text messages according to claim 7, characterized in that, The process of fusing and aggregating the analysis results specifically includes: performing keyword comparison, rule comparison, and SMS behavior analysis model analysis on the mobile phone SMS information, and fusing and aggregating the analysis results. The specific steps include: obtaining relevant SMS messages on the mobile phone through behavioral intent recognition; extracting key information from relevant SMS messages and key elements of reverse behavior; and characterizing and analyzing all relevant user behaviors.

11. The behavior analysis system based on mobile phone text messages according to claim 7, characterized in that, It also includes an iterative update unit: configured to manually process and train the mobile SMS data collected by the backend system and feed back the results to iteratively optimize the SMS behavior analysis model.

Images