Message detection method, apparatus and device

Abstract

Embodiments of the present application provide a message detection method, device and equipment, wherein the method comprises: when a terminal receives a communication message, determining a message source number corresponding to the communication message; determining a terminal number corresponding to the terminal as a message target number; constructing a message number pair by using the message source number and the message target number; determining a number relationship between the message source number and the message target number in the message number pair based on a pre-constructed number relationship graph; and performing message detection on the communication message based on the number relationship.

Description

Technical Field

[0001] This application relates to the field of security technology, and includes, but is not limited to, message detection methods, apparatus, and devices. Background Technology

[0002] With the development of 5G technology and the expansion of industry applications, 5G personal peer-to-peer messaging and 5G industry messaging are poised for rapid growth. 5G messaging is presenting new business models, and communication via 5G messaging (audio, video, images, and text, etc.) will become more frequent. Therefore, the volume of 5G messages will experience explosive growth, placing higher demands on 5G message content governance. Mainstream 5G multimedia messaging (including audio, video, images, and text) governance technologies primarily employ deep learning algorithms to detect the compliance of message content.

[0003] In related technologies, text violation detection typically relies on text models built using Natural Language Processing (NLP) techniques such as FastText, Hidden Markov Models (HMM), Conditional Random Fields (CRF), and Word2Vec to avoid false positives and false negatives from single models. For violation image detection, deep fusion of image models such as Inception, ResNet, Multi-task Cascaded Convolutional Networks (MTCNN), InsightFace, EAST, and CRNN is commonly used to identify various types of violation images. For audio violation recognition, deep fusion of audio models such as Generative Adversarial Networks (GAN), Time-Delay Neural Networks (TDNN), Long Short-Term Memory (LSTM), and Recurrent Neural Networks (RNN) is typically applied. For video violation recognition, deep fusion of Convolutional Neural Networks (CNN) is commonly used. Video models such as Network (CNN), RNN, CRNN, GAN, and TDNN are used for video violation detection.

[0004] However, text models, image models, audio and video models, etc., are all limited by the latency of complex model inference. When faced with large volumes of multimedia messages, there are problems with untimely detection. For example, the latency of mainstream audio in the industry is 0.1-0.2 seconds, the maximum response time of mainstream video filtering is 1 second, and the real-time processing rate is 30%. Summary of the Invention

[0005] Based on the problems in related technologies, embodiments of this application provide a message detection method, apparatus, and device.

[0006] The technical solution of this application embodiment is implemented as follows: This application provides a message detection method, the method comprising: when a terminal receives a communication message, determining the message source number corresponding to the communication message; determining the terminal number corresponding to the terminal as the message target number; constructing a message number pair by the message source number and the message target number; determining the number relationship between the message source number and the message target number in the message number pair based on a pre-constructed number relationship graph; and performing message detection on the communication message based on the number relationship.

[0007] This application provides a message detection device, which includes a determining module for determining the message source number corresponding to the communication message when a terminal receives a communication message; determining the terminal number corresponding to the terminal as the message target number; a constructing module for constructing a message number pair between the message source number and the message target number; the determining module is further used to determine the number relationship between the message source number and the message target number in the message number pair based on a pre-constructed number relationship graph; and a detection module for performing message detection on the communication message based on the number relationship.

[0008] In some embodiments, the apparatus further includes: an acquisition module, configured to acquire signaling data between preset number pairs, the service type of a target number in the preset number pair, and gateway data of the target number from a number database; the preset number pair includes the target number and a source number; the determination module is further configured to determine a first number relationship model, a second number relationship model, and a third number relationship model of the target number based on the signaling data, the service type, and the gateway data, respectively; and a fusion module, configured to perform model fusion processing on the first number relationship model, the second number relationship model, and the third number relationship model to obtain the number relationship graph.

[0009] In some embodiments, the first number relationship model includes at least one first-type friend relationship pair matching the target number; the second number relationship model includes at least one second-type friend relationship pair matching the target number; the third number relationship model includes at least one third-type friend relationship pair matching the target number; the fusion module is further configured to add the at least one first-type friend relationship pair, the at least one second-type friend relationship pair, and the at least one third-type friend relationship pair to a preset relationship library; the preset relationship library includes multiple friend relationship pairs; friend relationship pairs in the preset relationship library that are mistakenly identified as friend relationships are identified as target relationship pairs; and the target relationship pairs in the preset relationship library are removed to obtain the number relationship graph.

[0010] In some embodiments, the apparatus further includes: a model determination module, configured to extract features from the signaling data to obtain multiple intimacy vector features of the target number; compare the importance of the multiple intimacy vector features to obtain an importance judgment matrix corresponding to the multiple intimacy vector features; perform vector calculation on the importance judgment matrix to obtain the weight of each intimacy vector feature; perform weighted summation on the multiple intimacy vector features based on the weight of each intimacy vector feature to obtain the friend intimacy value of the preset number pair; when the friend intimacy value is greater than an intimacy threshold, determine that the source number and the target number are a number pair with a first type of friend relationship; add the number pair with the first type of friend relationship to a first number relationship set to form the first number relationship model.

[0011] In some embodiments, the apparatus further includes: a verification module, configured to perform a consistency check on the weight of each of the intimacy vector features in the importance judgment matrix; when the importance judgment matrix fails the consistency check, to perform an importance comparison on the plurality of intimacy vector features again to obtain a new importance judgment matrix corresponding to the plurality of intimacy vector features; when the importance judgment matrix passes the consistency check, to perform a weighted summation on the plurality of intimacy vector features.

[0012] In some embodiments, the model determination module is further configured to: acquire business data corresponding to the business type of the target number; determine multiple associated numbers associated with the target number under the business type based on the business data; determine each associated number and the target number as a number pair with a second type of friend relationship; add the number pair with the second type of friend relationship to a second number relationship set to form the second number relationship model.

[0013] In some embodiments, the model determination module is further configured to parse the gateway data to obtain a mapping table of gateway addresses corresponding to the gateway data, the mapping table including multiple mapping numbers under the same gateway address as the target number; determine each mapping number and the target number as a number pair with a third type of friend relationship; add the number pair with the third type of friend relationship to a third number relationship set to form the third number relationship model.

[0014] In some embodiments, the detection module is further configured to perform real-time message detection on the communication messages if the number relationship is a friend relationship, and to perform offline message detection on the communication messages if the number relationship is a non-friend relationship.

[0015] This application provides a message detection device, including: a memory for storing executable instructions; and a processor for implementing the message detection method described above when executing the executable instructions stored in the memory.

[0016] This application provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implement the aforementioned message detection method.

[0017] The message detection method, apparatus, and device provided in this application, based on received communication messages, determine the message source number and message target number corresponding to the communication message. After constructing the message source number and message target number as message number pairs, the number relationship between the message source number and message target number is determined based on a pre-constructed number relationship graph. Then, appropriate detection measures are selected based on the determined number relationship. Thus, the number relationship graph constructed based on signaling data, service type, and gateway data in this application embodiment can effectively improve the accuracy of message detection. In practical applications, the pre-constructed number relationship graph can be used to determine the friend relationship between the message target number and message source number corresponding to the communication message. Then, based on the determined friend relationship between the message target number and message source number, a personalized message detection method is applied to the communication message, enabling rapid and effective identification of illegal messages and improving the real-time rate of message detection. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the message detection system provided in an embodiment of this application; Figure 2 This is a flowchart illustrating the message detection method provided in the embodiments of this application. Figure 1 ; Figure 3 This is a schematic diagram of the process for constructing a number relationship graph provided in an embodiment of this application; Figure 4 This is a schematic diagram of the process for constructing a friend relationship graph provided in an embodiment of this application; Figure 5 This is an interactive schematic diagram of the intimacy vector feature relationship provided in the embodiments of this application; Figure 6 This is a schematic diagram of the judgment matrix provided in an embodiment of this application; Figure 7 This is a flowchart illustrating the message detection method provided in the embodiments of this application. Figure 2 ; Figure 8 This is a schematic diagram of the composition structure of the message detection device provided in the embodiments of this application; Figure 9 This is a schematic diagram of the composition structure of the message detection device provided in the embodiments of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] In the following description, references to "some embodiments" refer to a subset of all possible embodiments. However, it is understood that "some embodiments" may be the same or different subsets of all possible embodiments and may be combined with each other without conflict. Unless otherwise defined, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by one of ordinary skill in the art to which the embodiments of this application pertain. The terminology used in the embodiments of this application is for the purpose of describing the embodiments of this application only and is not intended to limit the application.

[0021] In related technologies, the detection of communication messages typically employs two methods: First, deep learning: Deep learning is widely used for message content detection. While this method can achieve an accuracy rate of 99%, the inference process is time-consuming, compromising the timeliness of message detection, especially for audio and video detection, where real-time accuracy cannot be guaranteed. Furthermore, with the massive increase in multimedia messages, the inability to quickly and effectively identify normal or illegal content may hinder timely implementation of appropriate governance measures, potentially creating network security risks and increasing the difficulty of network environment governance. Second, current friend relationship recognition technologies: These largely rely on interaction frequency and interaction indexes, utilizing subjective experience values ​​and existing attentional biases. This results in poor robustness under varying data volumes and business scenarios.

[0022] To address at least one of the aforementioned problems in related technologies, this application provides a message detection method. Based on a received communication message, the method determines the message source number and message target number corresponding to the message. After constructing the message source number and message target number as a message number pair, it determines the number relationship between the message source number and message target number based on a pre-constructed number relationship graph. Then, based on the determined number relationship, an appropriate detection measure is selected. Thus, the number relationship graph constructed based on signaling data, service type, and gateway data in this application can effectively improve the accuracy of message detection. In practical applications, the pre-constructed number relationship graph can be used to determine the friend relationship between the message target number and message source number corresponding to the communication message. Then, based on the determined friend relationship between the message target number and message source number, a personalized message detection method is applied to the communication message, enabling rapid and effective identification of illegal messages and improving the real-time rate of message detection.

[0023] The following describes exemplary applications of the message detection device according to embodiments of this application. The message detection device provided in this application can be implemented as a terminal or as a server. In one implementation, the message detection device provided in this application can be implemented as various types of terminals such as laptops, tablets, desktop computers, and mobile devices. In another implementation, the message detection device provided in this application can also be implemented as a server. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal and the server can be directly or indirectly connected via wired or wireless communication, and this application does not impose any limitations. The following will describe exemplary applications when the message detection device is implemented as a server.

[0024] join Figure 1 , Figure 1This is a schematic diagram of the message detection system provided in this application embodiment. To achieve message detection of communication messages, this application embodiment can provide a message detection platform, which can be implemented as a message detection application. The message detection system 10 provided in this application embodiment includes a terminal 100, a network 200, and a server 300, wherein the server 300 is the server for the message detection application. The server 300 can constitute the message detection device of this application embodiment. The terminal 100 is connected to the server 300 through the network 200, which can be a wide area network (WAN), a local area network (LAN), or a combination of both.

[0025] In some embodiments, please refer to Figure 1 During message detection, terminal 100 sends communication messages to server 300 via network 200. Server 300 determines the message source number corresponding to the communication message based on the communication message and determines the terminal number corresponding to the terminal as the message target number. After constructing a message number from the message source number and the message target number, the server determines the number relationship between the message source number and the message target number based on a pre-constructed number relationship graph, detects the communication message, and obtains the message detection result. After obtaining the message detection result, server 300 sends the message detection result back to the terminal via network 200.

[0026] In other embodiments, the terminal and server can interact to detect communication messages. The terminal 100 obtains the message source number corresponding to the communication message through the client of the communication message, determines the terminal number corresponding to the terminal as the message target number, and constructs a message number pair between the message source number and the message target number, which is then sent to the server 300. The server 300 determines the number relationship between the message source number and the message target number based on a pre-constructed number relationship graph and detects the communication message.

[0027] The message detection method provided in this application embodiment can also be implemented based on a cloud platform and through cloud technology. For example, the server 300 mentioned above can be a cloud server. The cloud server determines the number relationship between the message source number and the message destination number, and then detects the communication message.

[0028] In some embodiments, a cloud storage can also be provided, in which a number relationship graph pre-built by the server can be stored. Then, when the server receives a communication message sent by the terminal, it can accurately and efficiently determine the number relationship between the source number and the target number of the communication message based on the friend relationship pairs stored in the number relationship graph, and thus take corresponding message detection measures.

[0029] It's important to clarify that cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Cloud technology is a collective term for network technologies, information technologies, integration technologies, management platform technologies, and application technologies applied in the cloud computing business model. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will require robust system support, which can only be achieved through cloud computing.

[0030] This application provides a message detection method, see [link to relevant documentation]. Figure 2 , Figure 2 This is a flowchart illustrating the message detection method provided in the embodiments of this application. Figure 1 , will combine Figure 2 The steps shown are explained.

[0031] Step S201: When the terminal receives a communication message, it determines the message source number corresponding to the communication message.

[0032] In some embodiments, the terminal may be any terminal with messaging communication capabilities, such as a mobile device (e.g., mobile phone, satellite phone, portable music player, personal digital assistant, dedicated messaging device, portable gaming device), laptop computer, tablet computer, desktop computer, and smartwatch.

[0033] In some embodiments, the communication message can be a 4G or 5G message received by the terminal, or a 4G or 5G message sent by the terminal. The communication message can be any one or more types of messages, such as audio messages, video messages, image messages, and text messages. The communication message can be a message sent between a source number and a destination number using any message sending method. For example, the communication message can be a text message received via SMS, an image message or audio / video message received via MMS, or a text message or audio / video message received via email.

[0034] In some embodiments, the message source number can be the number that initiates the communication request. For example, if user A makes a phone call to user B, then the phone number corresponding to user A is the message source number; if user C sends an instant message to user D, then the instant messaging software account corresponding to user C is the message source number; if user E sends an email to user F, then the email account corresponding to user E is the message source number, and so on. In other words, the number that actively initiates a communication request to another party is the message source number. Here, the geographical location of the phone number, instant messaging software account, and email account is not specifically limited; any number capable of information exchange is considered a message source number.

[0035] Step S202: Determine the terminal number corresponding to the terminal as the message target number.

[0036] In some embodiments, the message target number can be understood as the number that receives the communication request. For example, if user A initiates a phone call to user B, then the phone number corresponding to user B is the message target number; if user C initiates an instant message to user D, then the instant messaging software account corresponding to user D is the message target number; if user E initiates an email to user F, then the email account corresponding to user F is the message target number. In other words, the number that receives the communication request initiated by the other party is the message target number.

[0037] Step S203: Construct a message number pair by combining the message source number and the message destination number.

[0038] In some embodiments, a message number pair refers to a pair of numbers consisting of two numbers that use the same communication method (such as telephone, email, SMS, and instant messaging), whose geographical location is not specifically limited, and where one party passively receives the communication request and the other actively initiates the communication request. In this case, the message detection system marks the message number pair to facilitate the detection of communication messages between the message number pairs.

[0039] The method described in this application can be applied to at least the following scenarios: When detecting a telephone call request received by a user terminal, the message detection system can determine the call request source number corresponding to the received call request based on the received call request, and then mark the user's mobile phone number as the call request target number. At this time, the message detection system binds the call request source number and the call request target number together, marking them as a call request number pair, i.e., the aforementioned message number pair.

[0040] Step S204: Based on the pre-constructed number relationship map, determine the number relationship between the message source number and the message target number in the message number pair.

[0041] In some embodiments, the number relationship graph can be a relationship graph obtained by fusing multiple different relationship models. This relationship graph includes, but is not limited to, relationship models trained based on various types of data related to the target number, and may also include relationship models of numbers that have a friendly relationship with the target number. Typically, these relationship models are pre-trained using relationship vector features of different dimensions, or are relationship models trained based on signaling data of the target number, or relationship models trained based on the service type of the target number, or relationship models trained based on home gateway data of the target number.

[0042] The relationship between a message source number and a message destination number includes, but is not limited to, friend relationships and non-friend relationships. In some embodiments, determining the relationship between a message source number and a message destination number in a message number pair may include: if a friend relationship pair corresponding to the message number pair can be matched from the number relationship graph, then the relationship between the message source number and the message destination number can be determined to be a friend relationship; if a friend relationship pair corresponding to the message number pair cannot be matched from the number relationship graph, then the relationship between the message source number and the message destination number can be determined to be a non-friend relationship.

[0043] Step S205: Based on the number relationship, perform message detection on the communication message.

[0044] In some embodiments, after the message detection system determines the number relationship between the message source number and the message target number based on a pre-built number relationship map, it can take corresponding detection measures for different number relationships to perform message detection. The detection measures include, but are not limited to, real-time detection and offline detection.

[0045] The message detection method provided in this application, based on the received communication message, determines the message source number and message target number corresponding to the communication message. After constructing the message source number and message target number as a message number pair, it determines the number relationship between the message source number and message target number based on a pre-constructed number relationship graph. Then, it selects appropriate detection measures based on the determined number relationship. Thus, the number relationship graph constructed based on signaling data, service type, and gateway data in this application embodiment can effectively improve the accuracy of message detection. In practical applications, the pre-constructed number relationship graph can be used to determine the friend relationship between the message target number and message source number corresponding to the communication message. Then, based on the known friend relationship between the message target number and message source number, a personalized message detection method is applied to the communication message, enabling the rapid and effective identification of illegal messages and improving the real-time rate of message detection.

[0046] In some embodiments, the message detection module in the message detection system may include an offline message detection module. The offline message detection module is mainly used to perform offline detection on the communication messages between number pairs that are determined to be friends in step S204 above, and to detect whether the communication messages involve illegal content.

[0047] In some embodiments, before detecting communication information, multiple models can be fused to obtain a number relationship graph. Based on the number relationship graph, a preliminary judgment can be made on whether message number pairs have a friend relationship, thus ensuring the real-time nature of message detection. Based on the foregoing embodiments, this application provides a method for constructing a number relationship graph, which can be executed by a server. Figure 3 This is a schematic diagram of the process for constructing a number relationship graph provided in an embodiment of this application, such as... Figure 3 As shown, it will be combined Figure 3 The steps shown are explained.

[0048] Step S301: The server obtains signaling data between preset number pairs, the service type of the target number in the preset number pair, and the gateway data of the target number from the number database; the preset number pair includes the target number and the source number.

[0049] In some embodiments, a preset number pair refers to a pair of numbers that are friends. A number database refers to a database stored on a server for storing multiple preset number pairs; the data in the number database can be updated via the server. Here, the frequency of updating the stored numbers can be preset by the server, for example, updating the number database every hour.

[0050] In some embodiments, any target number can be used as the source number, and the historical behavioral characteristics corresponding to the source number can be obtained and analyzed. Based on the results of the historical behavioral analysis, all other numbers that have communicated with the source number are identified, as well as the interaction frequency between the source number and each of these other numbers. Other numbers with an interaction frequency greater than a frequency threshold are identified as friend numbers of the source number, i.e., a friend relationship is determined between the source number and these other numbers. The aforementioned historical behavioral characteristics include, but are not limited to: call duration, interaction duration, number of interactions, and interaction frequency; where interactions include, but are not limited to: sharing, commenting, liking, and sending messages.

[0051] In some embodiments, any number can be used as the target number, and the historical behavioral characteristics corresponding to the target number can be obtained and analyzed. Based on the historical behavioral analysis results, all other numbers that communicate with the target number are identified, as well as the interaction results between the target number and each of the other numbers. Other numbers whose interaction results meet preset conditions are identified as friend numbers of the target number, that is, the friend relationship between the target number and the other numbers is determined. The aforementioned historical behavioral characteristics include, but are not limited to, binding a family card, binding a primary and secondary card, etc. In other words, in some embodiments, when the server identifies historical behavioral characteristics including but not limited to those listed above, the server automatically marks the target number and source number containing the aforementioned historical behavioral characteristics as a preset number pair, thereby storing the preset number pair in the number database and updating the number database. Of course, the server can also add preset number pairs determined through signaling data, service type, or gateway data to the number database and update the number database.

[0052] Step S302: Based on the signaling data, the server determines the first number relationship model of the target number.

[0053] In some embodiments, signaling data can be various dimensions of data, such as call data, location data, and consumption data of the target number obtained by the server from the information security center.

[0054] In some embodiments, the first number relationship model may include at least one first-class friend relationship pair that matches the target number.

[0055] In some embodiments, step S302 may include steps S3021 to S3027.

[0056] Step S3021: The server extracts features from the signaling data to obtain multiple proximity vector features of the target number.

[0057] In this embodiment, the server can extract features from the call data in the signaling data of the target number, such as the number of calls, total call duration, number of call days, percentage of proactive disconnections, percentage of outgoing calls, interaction relationships, triangular relationships, and quadrangular relationships, which can map social intimacy vector features. Here, the percentage of proactive disconnections refers to the proportion of times one party in a preset number pair actively hangs up the phone in all calls; the percentage of outgoing calls refers to the proportion of calls initiated by the target number in a preset number pair; the interaction relationship refers to the relationship between the target number and the source number in the preset number pair that mutually initiate communication requests; the triangular relationship refers to the relationship between the target number and the source number in the preset number pair that mutually initiate communication requests, and both of them also have communication request relationships with third-party numbers; the quadrangular relationship refers to the relationship between the target number and the source number in the preset number pair that initiate communication requests, and the relationship between number A communicating with the target number and number B communicating with the source number that initiate communication requests. Of course, in some embodiments, the more interaction relationships, triangular relationships, and quadrangular relationships there are in the number relationship graph, the closer the friendship is.

[0058] In step S3022, the server compares the importance of the multiple intimacy vector features to obtain an importance judgment matrix corresponding to the multiple intimacy vector features.

[0059] In some embodiments, the server can compare the relative importance of features between every two affinity vectors to obtain comparison results, and then construct an importance judgment matrix based on the comparison results. Of course, the importance judgment matrix can also be constructed in other ways, and this application embodiment does not specifically limit this.

[0060] In some embodiments, the server can rank the relative importance of multiple intimacy vector features, typically into three levels: equally important, slightly important, and significantly important. Then, the server can select any two intimacy vector features, assign values ​​to them, and compare the values ​​assigned each time to determine the importance judgment matrix. For example, the number of calls and the number of call days might be assigned a value of 1 as being of equal importance.

[0061] In step S3023, the server performs vector calculation on the importance judgment matrix to obtain the weight of each of the intimacy vector features.

[0062] In some embodiments, the server can perform vector calculations on the importance judgment matrix obtained by subjective-objective fusion to obtain the weight of each intimacy vector feature. Here, subjective-objective fusion refers to combining the importance judgment matrix obtained by actual objective calculation with the subjectively set importance judgment.

[0063] Step S3024: The server performs a consistency check on the weights of each affinity vector feature in the importance judgment matrix.

[0064] In some embodiments, consistency refers to data remaining consistent. In a distributed system, this can be understood as the data values ​​being consistent across multiple nodes. In other words, consistency testing verifies the consistency of the weights of the proximity vector features in the importance judgment matrix.

[0065] Step S3025: When the importance judgment matrix passes the consistency test, the multiple intimacy vector features are weighted and summed to obtain the friend intimacy value of the preset number pair.

[0066] In some embodiments, when the importance judgment matrix fails the consistency test, the importance of multiple closeness vector features is compared again to obtain a new importance judgment matrix corresponding to the multiple closeness vector features.

[0067] In some embodiments, the consistency check can be determined in the following way: First, the server calculates the largest eigenvalue of the importance judgment matrix. Second, the server substitutes the obtained largest eigenvalue into the calculation formula of the consistency index to obtain the value of the consistency index. When the server finds that the consistency index value is greater than a preset threshold, the server determines that the importance judgment matrix has failed the consistency check. When the server finds that the consistency index value is less than the preset threshold, the server determines that the importance judgment matrix has passed the consistency check.

[0068] Step S3026: When the friend intimacy value is greater than the intimacy threshold, determine that the source number and the target number are a number pair with a first type of friend relationship.

[0069] In some embodiments, the friend intimacy value is used to characterize the degree of intimacy between the source number and the target number, and the intimacy threshold is used to characterize the minimum intimacy value for the source number and the target number to be friends. The intimacy threshold can be set according to actual needs, for example, the intimacy threshold can be 60.

[0070] In step S3027, the server adds the number pairs with the first type of friend relationship to the first number relationship set to form the first number relationship model.

[0071] In some embodiments, when the server determines that the intimacy value between the current number pairs is greater than the intimacy threshold, it marks the number pairs constructed by the target number and the source number as number pairs with a first type of friend relationship, and then adds these number pairs with a first type of friend relationship to a preset first type of friend relationship set to form a first number relationship model.

[0072] Step S303: The server determines the second number relationship model of the target number based on the business type.

[0073] In some embodiments, the server determines a second number relationship model for the target number based on the service type. Here, the service type can be a service subscription relationship based on a province, such as a family network service, a happy family service, a group V network service, a campus network service, a primary and secondary SIM card service, a data sharing user group service, and a personalized package service, etc.

[0074] In some embodiments, the second number relationship model may include at least one second-type friend relationship pair that matches the target number.

[0075] In some embodiments, step S303 may include steps S3031 to S3034.

[0076] Step S3031: The server obtains the service data corresponding to the service type of the target number.

[0077] In some embodiments, business data is used to characterize the data of the corresponding business type activated under the target number name. The server can determine multiple associated numbers associated with the target number under a business type through the business data corresponding to the business type.

[0078] Step S3032: The server determines, based on the business data, multiple associated numbers associated with the target number under the business type.

[0079] In step S3033, the server determines each of the associated numbers and the target number as a number pair with a second type of friend relationship.

[0080] In some embodiments, after determining the target number corresponding to the communication message, the server can extract the service types activated under the target number to obtain the service data of the target number. For example, number 1 is the main number, which is the target number in this embodiment. It is known that the main number 1 has activated the Family Network service and has three Family Network numbers under its name: number 2, number 3, and number 4. These Family Network numbers are the associated numbers of the target number. Then, based on the activation of the Family Network service by the main number 1, the friend relationship pairs that can be constructed are: main number 1 and number 2 are family relationships; main number 1 and number 3 are family relationships; main number 1 and number 4 are family relationships. Similarly, the way to construct friend relationship pairs for other types of service packages is the same. Here, the friend relationship pairs of main number 1 with number 2, number 3, and number 4 are marked as number pairs with the second type of friend relationship.

[0081] In step S3034, the server adds the number pairs with the second type of friend relationship to the second number relationship set to form the second number relationship model.

[0082] In some embodiments, after the server marks the number pairs constructed by the target number and the associated number as number pairs with a second type of friend relationship based on business data, it adds these number pairs with a second type of friend relationship to a preset second type of friend relationship set to form a second number relationship model.

[0083] Step S304: Based on the gateway data, the server determines the third number relationship model of the target number.

[0084] In some embodiments, the third number relationship model may include at least one third-class friend relationship pair that matches the target number.

[0085] In some embodiments, step S304 may include steps S3041 to S3043.

[0086] Step S3041: The server parses the gateway data to obtain a mapping table of gateway addresses corresponding to the gateway data. The mapping table includes multiple mapped numbers that are under the same gateway address as the target number.

[0087] In some embodiments, the server can first collect gateway data of the home gateway to which the target number belongs. For example, traffic reported by the home gateway plugin. Then, deep packet inspection (DIP) is used to parse the gateway data of the target number to obtain a mapping table of the corresponding gateway addresses. Here, the mapping table can be determined in the following way: using the judgment rule of the gateway to which the number belongs, that is, if number A appears more than 20 times in the traffic records of the home gateway to which number B belongs, it can be considered that there is a mapping relationship between number A and the home gateway of number B, that is, number A is the mapped number of number B.

[0088] In step S3042, the server determines each of the mapped numbers and the target number as a number pair with a third type of friend relationship.

[0089] In this embodiment, after determining the target number corresponding to the communication message, the server can parse the gateway data of the home gateway to which the target number belongs to obtain a mapping table of gateway addresses corresponding to the gateway data. For example, there are three mapped numbers under the same home gateway: number 1, number 2, and number 3. That is to say, based on the mapping relationship, the friend relationship pairs that can be constructed are: number 1 and number 2, number 2 and number 3, and number 3 and number 1. Here, the friend relationship pairs constructed based on the mapping relationship are marked as number pairs with a third type of friend relationship.

[0090] In step S3043, the server adds the number pairs with the third type of friend relationship to the third number relationship set to form the third number relationship model.

[0091] In some embodiments, after the server marks the number pairs constructed based on gateway data as number pairs with a third type of friend relationship, it adds these number pairs with a third type of friend relationship to a preset third type of friend relationship set to form a third number relationship model.

[0092] Step S305: The server performs model fusion processing on the first number relationship model, the second number relationship model, and the third number relationship model to obtain the number relationship graph.

[0093] In some embodiments, step S305 may include steps S3051 to S3053.

[0094] Step S3051: The server adds the at least one first-type friend relationship pair, the at least one second-type friend relationship pair, and the at least one third-type friend relationship pair to a preset relationship database; the preset relationship database includes multiple friend relationship pairs.

[0095] In step S3052, the server identifies the friend relationship pairs in the preset relationship database that were mistakenly identified as friend relationships as target relationship pairs.

[0096] In some embodiments, a friend pair that is mistakenly identified as a friend refers to a pair where, although there is a certain level of intimacy, one of the members is marked as a violation number, an abnormal number, or a number with certain work-related attributes.

[0097] Step S3053: The server performs a removal process on the target relationship pairs in the preset relationship database to obtain the number relationship graph.

[0098] In some embodiments, after the server determines a pair of friend relationships that were mistakenly identified as friend relationships to be target relationship pairs, in order to ensure the accuracy of message detection, the server needs to remove these mistaken friend relationship pairs from the first number relationship model, the second number relationship model, and the third number relationship model to obtain a number relationship graph with higher accuracy. For example, if number 1 has friend relationships with numbers 2, 3, 4, and 5, where number 5 is a reported violation number or is marked as a delivery or takeout number, then the server needs to remove the number pair with number 5 from the preset relationship database. Similarly, if number 4 has friend relationships with numbers 1, 6, and 7, where number 6 sends a communication message involving violation content to number 4, and number 4 sends a communication message without violation content to numbers 1 and 7, then the server needs to remove the friend relationship pair between number 4 and number 6 from the preset relationship database, retaining only the friend relationship pairs between number 1 and number 4, and number 4 and number 7.

[0099] In some embodiments, message detection is performed on communication messages based on number relationships, including: if the number relationship is a friend relationship, real-time message detection is performed on the communication messages; if the number relationship is not a friend relationship, offline message detection is performed on the communication messages. That is, the server can determine whether the number relationship between the source number and the destination number in a message number pair is a friend relationship by querying the number relationship graph. When a friend relationship is determined, the content of the communication message is initially determined to be non-violation-related. Then, the server further detects the communication message using an offline detection module to check for any potential missed detections. If no missed detections are found, the detection ends; if missed detections are found, the communication message involving violations is output. Here, a missed detection means that a communication message involving violations is determined to be a communication message without violations. When a non-friend relationship is determined, real-time detection is performed on the communication message to distinguish between communication messages involving violations and those without. If violations are involved, the communication message is output; otherwise, the detection ends.

[0100] In this embodiment of the application, in order to ensure the accuracy of the judgment of friend relationship pairs, the server needs to remove friend relationship pairs with the above characteristics from the preset relationship database. Then, the first number relationship model, the second number relationship model and the third number relationship model are fused to obtain a more accurate number relationship map.

[0101] The following will describe an exemplary application of the embodiments of this application in a real-world application scenario.

[0102] In this embodiment of the application, a friend relationship model (i.e., the first number relationship model) is first constructed based on signaling data, and a friend relationship model (i.e., the second number relationship model and the third number relationship model) is constructed by integrating service ordering information (i.e., service type) and family service data (i.e., gateway data). After removing non-friend relationships from the illegal numbers, the final friend relationship graph (i.e., the number relationship graph) is obtained.

[0103] This application provides a message detection method based on a friend relationship graph, which is executed by a server. Figure 4 This is a schematic diagram of the process for constructing a friend relationship graph provided in an embodiment of this application, such as... Figure 4 As shown, it will be combined Figure 4 The schematic diagram of the framework shown is used for illustration.

[0104] In this embodiment of the application, the server can construct a friend relationship model one based on signaling data. The friend relationship model one can be constructed by the following steps: The server uses signaling data from the information security center to select eight features that reflect social intimacy, such as the number of calls, total call duration, number of call days, percentage of proactive releases, percentage of callers, interaction relationships, triangular relationships, and quadrangular relationships. After weighted summation, a friend intimacy model is obtained, as shown in formula (1): (1) Where F is the friend intimacy value, F > At that time, they are considered friends; For eigenvalues; The feature normalization function maps each feature value to [0,1]; w i As weight; The intimacy threshold is set by experts or calculated using a specific method.

[0105] In some embodiments, to facilitate understanding of the meaning represented by the above-mentioned intimacy vector features, Table 1 and... Figure 5 To further explain, Table 1 is an explanation table of the intimacy vector features provided in the embodiments of this application. Figure 5 This is an interactive schematic diagram of the intimacy vector feature relationship provided in the embodiments of this application, such as... Figure 5 As shown. Here, the interaction relationship can be understood as the target number and source number in the preset number pair having initiated call requests to each other, such as... Figure 5 Numbers 1 and 7 in the pair represent interactive relationships; the more interactive relationships, the closer the friendship. A triangular relationship can be understood as the target number and source number in a pre-defined number pair having initiated call requests to each other, and both having made call requests to a third-party number, such as... Figure 5Numbers 1, 5, and 6 in the list represent a triangular relationship; the more triangular relationships there are, the closer the friendship. A four-corner relationship can be understood as a pre-defined number pair where the target number and source number have initiated call requests to each other, and where target number A and target number B have also initiated call requests to each other. Figure 5 Numbers 1, 2, 3, and 4 in the list represent four-corner relationships. The more four-corner relationships there are, the closer the friendship is. To make it easier to distinguish, the object number that has made a call request to the target number is defined as object number A, and the object number that has made a call request to the source number is defined as object number B.

[0106] Table 1 Feature Ai Table

[0107] The server uses a subjective-objective fusion judgment matrix (i.e., an importance judgment matrix) method to determine the weight of each feature. The relative importance of each pair of features is compared using expert experience to obtain a judgment matrix. Then, the weight of each feature is calculated using the geometric mean method, and finally, a consistency check is performed to confirm the rationality of the weights.

[0108] In this embodiment, the importance judgment matrix can be constructed in the following way: The relative importance of the eight intimacy vector features listed above is scored. Here, relative importance includes, but is not limited to, three levels: equally important, slightly important, and significantly important. The eight intimacy vector features can be represented by matrix elements in the importance judgment matrix, labeled with three importance values: 1, 3, and 5, respectively. To facilitate understanding of this comparison process, Figure 6 This was further explained. Figure 6 This is a schematic diagram of the judgment matrix provided in the embodiments of this application. It includes, but is not limited to: Equally important: Intimacy vector feature 1 and intimacy vector feature 2 are equally important, then M(1,2)=1, M(1,2)=1; Slightly important: Intimacy vector feature 1 is slightly more important than intimacy vector feature 2, then M(1,2)=3, M(2,1)=1 / 3; Significantly important: Intimacy vector feature 1 is significantly more important than intimacy vector feature 2, then M(1,2)=5, M(2,1)=1 / 5. For example, the number of days of phone calls is significantly more important than the number of interaction relationships, M(2,5)=5, M(5,2)=1 / 5.

[0109] In this embodiment, the process of calculating the weights of the intimacy vector features can be explained by the following steps: Step 1, the row vectors in the judgment matrix M need to be normalized. Here, normalization means converting the parameters of multiple vectors with different dimensions in the judgment matrix M into vector parameters with the same dimension, which facilitates subsequent calculation. Step 2, the vectors in the judgment matrix M are multiplied by row to obtain new column vectors. Step 3, each vector in the newly obtained column vector is raised to the nth power. The weights calculated above can be represented by formula (2): (2) Among them, w i As weight; The importance threshold is set by experts or calculated using a specific method; i represents the number of vector elements; k represents the number of rows in the importance judgment matrix; and j represents the number of columns in the importance judgment matrix. For example, it can be based on... Figure 5 The weights w = [0.21, 0.21, 0.13, 0.06, 0.06, 0.06, 0.21, 0.06] of the above eight affinity vector features are obtained by calculating the vector parameters of the judgment matrix.

[0110] In this embodiment, consistency verification can be performed using the following method. First, the root-finding method is used to calculate the largest eigenvalue of the judgment matrix M based on formula (3). ; (3) For example, when When the expression = [2.22,2.22,1.06,0.40933333,0.40933333,0.40933333,2.22,0.40933333] is given, it can be obtained according to formula (3): =8.393. At this point, the consistency index can be used... If we use CI to characterize this, then CI = 5.0398. Here, CI = 0 indicates that the weights of the intimacy vector features in the judgment matrix are completely consistent; 0 < CI < 0.1 indicates that the weights of the intimacy vector features in the judgment matrix are relatively consistent; CI > 0.1 indicates that the consistency of the weights of the intimacy vector features in the judgment matrix is ​​poor. Simultaneously, based on CR (test coefficient) = CI (consistency index) / RI (random consistency index) < 0.1, it indicates that the consistency test has been passed, meaning that the judgment matrix obtained by comparing pairwise intimacy vector features is within a reasonable range. Generally, if the test coefficient CR < 0.1, the judgment matrix is ​​considered to have passed the consistency test; otherwise, the judgment matrix should be modified. To measure the magnitude of CI, a random consistency index RI can usually be introduced. For example, Satty's random consistency index RI is shown in Table 2. Table 2 Random Consistency Index (RI)

[0111] In some embodiments, when calculating whether the number pair consisting of number 1 and number 2 is a friend relationship pair, the friend intimacy value between number 1 and number 2 can be calculated by formula (1) and table 3 to obtain the friend intimacy value between number 1 and number 2.

[0112] Table 3 Example table of features Ai

[0113] In some embodiments, the friend relationship set one (i.e., the first number relationship set) set based on signaling data is further explained in Table 4.

[0114] Table 4. Set of Friendships

[0115] In this embodiment, the server can construct a second friend relationship model based on service subscription information. The first friend relationship model can be constructed by the following steps: the server extracts friend relationships from the service subscription information based on the provincial company's service subscription relationships (such as family networks, happy families, primary and secondary cards, data sharing user groups, group V networks, campus networks, personalized packages, etc.) to construct the second friend relationship model.

[0116] In some embodiments, the server can obtain the business order information of the main number 1. Through querying, the following information can be obtained: The main number 1 has three family network numbers: number 2, number 3, and number 4. Therefore, the family network-based friend relationships of the main number 1 include: number 1 and number 2, number 1 and number 3, and number 1 and number 4. Because these are family network-based friend relationships, the friend relationship between number 1 and other numbers is a family relationship. Similarly, the extraction method for other business order information is the same. The second friend relationship set (i.e., the second number relationship set) set based on the business order information is further explained in Table 4.

[0117] Table 4. Set of Friendships II

[0118] In this embodiment, the server can construct a third friend relationship model based on family business data. The third friend relationship model can be constructed through the following steps: The server collects traffic reported by the family gateway plugin, analyzes the gateway plugin traffic using Deep Packet Inspection (DPI) technology, and obtains the mapping relationship between terminal numbers and gateway addresses. The server uses the rules for determining the gateway to which a terminal number belongs. If a terminal number appears more than 20 times in the traffic of a gateway, the server obtains a table showing the relationship between gateway addresses and terminal numbers, as shown in Table 5. For example, if numbers 1, 2, and 3 are under the same family gateway, then numbers 1 and 2, 2 and 3, and 1 and 3 are all friend relationships with family attributes.

[0119] Table 5. Relationship between Gateway Address and Terminal Number

[0120] In some embodiments, the third set of friend relationships based on family business data (i.e., the third number relationship set) is further explained in Table 6.

[0121] Table 6. Set of Friendships (Part 3)

[0122] In some embodiments, the first number relationship model includes at least one first-type friend relationship pair matching the target number; the second number relationship model includes at least one second-type friend relationship pair matching the target number; and the third number relationship model includes at least one third-type friend relationship pair matching the target number.

[0123] In this embodiment, the server can merge the aforementioned friend relationship model one, friend relationship model two, and friend relationship model three to obtain a fused model. The fused model yields a friend relationship set. The server can then remove numbers that are mistakenly identified as friends from the friend relationship set to improve the accuracy of friend relationship analysis. For example, if number 1 has friend relationships with numbers 2, 3, 4, and 5, and number 5 is a number reported by an administrative department or a reported violation number, then the server needs to remove the numbers that have friend relationships with number 5 from the friend relationship set. Similarly, if number 4 has friend relationships with numbers 1, 6, and 7, and number 6 sends a violation message to number 4, while number 4 sends normal content to numbers 1 and 7, then the server needs to remove the numbers that have friend relationships with numbers 4 and 6 from the friend relationship set, retaining the friend relationships between number 4 and number 1, and number 4 and number 7.

[0124] The following will describe an exemplary application of the embodiments of this application in another practical application scenario.

[0125] This application provides another message detection method, see [link to previous document]. Figure 7 , Figure 7 This is a flowchart illustrating the message detection method provided in the embodiments of this application. Figure 2 , will combine Figure 7 The steps shown are explained.

[0126] Step S701: Based on the communication message received by the terminal, the server determines the message number pair corresponding to the communication message. The message number pair includes the message source number and the message destination number of the communication message.

[0127] In step S702, the server will query the number relationship between the message source number and the message destination number in the message number pair based on the number relationship graph.

[0128] Step S703: If the number relationship is a friend relationship, perform real-time message detection on the communication messages.

[0129] Step S704: If the number relationship is not a friend relationship, perform offline message detection on the communication message.

[0130] In some embodiments, the server can determine whether the relationship between the source and destination numbers in a message number pair is a "friend" relationship by querying a number relationship graph based on the communication messages sent between the message number pairs. If a friend relationship is confirmed, the content of the communication message is initially determined to be non-violation-related. The server then uses an offline detection module to further detect the communication message to check for any potential missed detections. If no missed detections are found, the detection ends; if missed detections are found, the communication message involving violations is output. Here, a missed detection means that a communication message involving violations is determined to be a non-violation-related message. If a non-friend relationship is confirmed, the communication message is detected in real-time to distinguish between communication messages involving and not involving violations. If violations are found, the communication message is output; otherwise, the detection ends.

[0131] This application embodiment determines the source number and target number of the received communication message based on the received communication message. After constructing the source number and target number as a message number pair, the relationship between the source number and target number is determined based on a pre-constructed number relationship graph. Then, appropriate detection measures are selected based on the determined number relationship. In practical applications, the relationship between the target number and source number of the communication message can be determined through a pre-constructed number relationship graph. Then, based on the determined relationship between the target number and source number, a personalized message detection method is applied to the communication message. This allows for the rapid and effective identification of illegal messages, improving the real-time rate of message detection.

[0132] Figure 8 This is a schematic diagram of the composition structure of the message detection device provided in the embodiments of this application, as shown below. Figure 8 As shown, the message detection device 800 includes: a determination module 801, used to determine the message source number corresponding to the communication message when the terminal receives the communication message; and to determine the terminal number corresponding to the terminal as the message target number; a construction module 802, used to construct a message number pair by the message source number and the message target number; the determination module 801 is further used to determine the number relationship between the message source number and the message target number in the message number pair based on a pre-constructed number relationship map; and a detection module 803, used to perform message detection on the communication message based on the number relationship.

[0133] In some embodiments, the message detection device further includes: an acquisition module, configured to acquire signaling data between preset number pairs, the service type of a target number in the preset number pair, and gateway data of the target number from a number database; the preset number pair includes the target number and a source number; the determination module is further configured to determine a first number relationship model, a second number relationship model, and a third number relationship model of the target number based on the signaling data, the service type, and the gateway data, respectively; and a fusion module, configured to perform model fusion processing on the first number relationship model, the second number relationship model, and the third number relationship model to obtain the number relationship graph.

[0134] In some embodiments, the first number relationship model includes at least one first-type friend relationship pair matching the target number; the second number relationship model includes at least one second-type friend relationship pair matching the target number; the third number relationship model includes at least one third-type friend relationship pair matching the target number; the fusion module is further configured to add the at least one first-type friend relationship pair, the at least one second-type friend relationship pair, and the at least one third-type friend relationship pair to a preset relationship library; the preset relationship library includes multiple friend relationship pairs; friend relationship pairs in the preset relationship library that are mistakenly identified as friend relationships are identified as target relationship pairs; and the target relationship pairs in the preset relationship library are removed to obtain the number relationship graph.

[0135] In some embodiments, the message detection device further includes: a model determination module, configured to extract features from the signaling data to obtain multiple intimacy vector features of the target number; compare the importance of the multiple intimacy vector features to obtain an importance judgment matrix corresponding to the multiple intimacy vector features; perform vector calculation on the importance judgment matrix to obtain the weight of each intimacy vector feature; perform weighted summation on the multiple intimacy vector features based on the weight of each intimacy vector feature to obtain the friend intimacy value of the preset number pair; when the friend intimacy value is greater than an intimacy threshold, determine that the source number and the target number are a number pair with a first type of friend relationship; add the number pair with the first type of friend relationship to a first number relationship set to form the first number relationship model.

[0136] In some embodiments, before weighting the judgment matrix, the apparatus further includes: a verification module, configured to perform a consistency verification on the weight of each of the intimacy vector features in the judgment matrix; when the importance judgment matrix fails the consistency verification, to perform an importance comparison on the plurality of intimacy vector features again to obtain a new importance judgment matrix corresponding to the plurality of intimacy vector features; when the judgment matrix passes the consistency verification, to perform a weighted summation on the plurality of intimacy vector features.

[0137] In some embodiments, the model determination module is further configured to: acquire business data corresponding to the business type of the target number; determine multiple associated numbers associated with the target number under the business type based on the business data; determine each associated number and the target number as a number pair with a second type of friend relationship; add the number pair with the second type of friend relationship to a second number relationship set to form the second number relationship model.

[0138] In some embodiments, the model determination module is further configured to parse the gateway data to obtain a mapping table of gateway addresses corresponding to the gateway data, the mapping table including multiple mapping numbers under the same gateway address as the target number; determine each mapping number and the target number as a number pair with a third type of friend relationship; add the number pair with the third type of friend relationship to a third number relationship set to form the third number relationship model.

[0139] In some embodiments, the detection module is further configured to perform real-time message detection on the communication messages if the number relationship is a friend relationship, and to perform offline message detection on the communication messages if the number relationship is a non-friend relationship.

[0140] It should be noted that the description of the apparatus in this application embodiment is similar to the description of the method embodiment described above, and has similar beneficial effects as the method embodiment; therefore, it will not be repeated. For technical details not disclosed in this apparatus embodiment, please refer to the description of the method embodiment of this application for understanding.

[0141] It should be noted that, in the embodiments of this application, if the above-described light adjustment method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0142] Correspondingly, embodiments of this application provide a message detection device. Figure 9 This is a schematic diagram of the composition structure of the message detection device provided in the embodiments of this application, such as... Figure 9 As shown, the message detection device 900 includes at least a processor 901 and a computer-readable storage medium 902 configured to store executable instructions, wherein the processor 901 typically controls the overall operation of the message detection device. The computer-readable storage medium 902 is configured to store instructions and applications executable by the processor 901, and may also cache data to be processed or processed by various modules in the processor 901 and the message detection device 900, and can be implemented using flash memory or random access memory (RAM).

[0143] This application provides a storage medium storing executable instructions. When these executable instructions are executed by a processor, they cause the processor to perform the method provided in this application, for example... Figure 2 The method shown.

[0144] In some embodiments, the storage medium may be a computer-readable storage medium, such as a ferromagnetic random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic surface memory, optical disc, or a compact disk-read-only memory (CD-ROM); or it may be a device that includes one or any combination of the above-mentioned memories.

[0145] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0146] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file containing other programs or data, for example, in one or more scripts within a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., files storing one or more modules, subroutines, or code sections). As an example, executable instructions may be deployed to execute on a single electronic device, or on multiple electronic devices located in one location, or on multiple electronic devices distributed across multiple locations and interconnected via a communication network.

[0147] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

[0148] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0149] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components may be combined, or integrated into another system, or some features may be ignored or not performed.

[0150] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A message detection method, characterized in that, The method includes: When the terminal receives a communication message, it determines the message source number corresponding to the communication message; The terminal number corresponding to the terminal is determined as the message target number; The message source number and the message destination number are combined into a message number pair; Based on a pre-constructed number relationship graph, the number relationship between the message source number and the message destination number in the message number pair is determined; Based on the number relationship, message detection is performed on the communication message; The method further includes: Retrieve signaling data between preset number pairs from the number database, the service type of the target number in the preset number pair, and the gateway data of the target number; the preset number pair includes the target number and the source number; Based on the signaling data, the service type, and the gateway data, a first number relationship model, a second number relationship model, and a third number relationship model are determined for the target number, respectively. The first number relationship model, the second number relationship model, and the third number relationship model are fused to obtain the number relationship map.

2. The method according to claim 1, characterized in that, The first number relationship model includes at least one first-type friend relationship pair matching the target number; the second number relationship model includes at least one second-type friend relationship pair matching the target number; and the third number relationship model includes at least one third-type friend relationship pair matching the target number. The process of fusing the first number relationship model, the second number relationship model, and the third number relationship model to obtain the number relationship graph includes: The at least one first-type friend relationship pair, the at least one second-type friend relationship pair, and the at least one third-type friend relationship pair are added to a preset relationship library; the preset relationship library includes multiple friend relationship pairs. The friend relationship pairs in the preset relationship database that were mistakenly identified as friend relationships are identified as target relationship pairs; The target relationship pairs in the preset relationship database are removed to obtain the number relationship graph.

3. The method according to claim 1, characterized in that, The first number relationship model is determined in the following way: Feature extraction is performed on the signaling data to obtain multiple proximity vector features of the target number; The importance of the multiple intimacy vector features is compared to obtain an importance judgment matrix corresponding to the multiple intimacy vector features; The importance judgment matrix is ​​subjected to vector calculation to obtain the weight of each of the intimacy vector features; Based on the weight of each of the aforementioned intimacy vector features, the multiple intimacy vector features are weighted and summed to obtain the friend intimacy value of the preset number pair; When the friend intimacy value is greater than the intimacy threshold, the source number and the target number are determined to be a number pair with a first-type friend relationship; Add the number pairs with the first type of friend relationship to the first number relationship set to form the first number relationship model.

4. The method according to claim 3, characterized in that, Before performing weighted processing on the importance judgment matrix, the method further includes: A consistency check is performed on the weights of each affinity vector feature in the importance judgment matrix; When the importance judgment matrix fails the consistency test, the importance of the multiple intimacy vector features is compared again to obtain a new importance judgment matrix corresponding to the multiple intimacy vector features; When the importance judgment matrix passes the consistency test, the multiple affinity vector features are weighted and summed.

5. The method according to claim 1, characterized in that, The second number relationship model is determined in the following way: Obtain the business data corresponding to the business type of the target number; Based on the business data, determine multiple associated numbers associated with the target number under the business type; Each of the associated numbers and the target number is identified as a number pair with a second type of friend relationship; Add the number pairs with the second type of friend relationship to the second number relationship set to form the second number relationship model.

6. The method according to claim 1, characterized in that, The third number relationship model is determined in the following way: The gateway data is parsed to obtain a mapping table of gateway addresses corresponding to the gateway data. The mapping table includes multiple mapped numbers that are under the same gateway address as the target number. Each of the mapped numbers and the target number is identified as a number pair with a third type of friend relationship; Add the number pairs with the third type of friend relationship to the third number relationship set to form the third number relationship model.

7. The method according to claim 1, characterized in that, The message detection based on the number relationship includes: If the number relationship is a friend relationship, perform real-time message detection on the communication messages; If the number relationship is not a friend relationship, perform offline message detection on the communication message.

8. A message detection device, characterized in that, The device includes: The determination module is used to determine the message source number corresponding to the communication message when the terminal receives the communication message; and to determine the terminal number corresponding to the terminal as the message target number. A construction module is used to construct a message number pair from the message source number and the message destination number; The determining module is further configured to determine the number relationship between the message source number and the message target number in the message number pair based on a pre-constructed number relationship graph; The detection module is used to perform message detection on the communication messages based on the number relationship; The acquisition module is used to acquire signaling data between preset number pairs, the service type of the target number in the preset number pair, and the gateway data of the target number from the number database; the preset number pair includes the target number and the source number; The determining module is further configured to determine a first number relationship model, a second number relationship model, and a third number relationship model for the target number based on the signaling data, the service type, and the gateway data, respectively. The fusion module is used to perform model fusion processing on the first number relationship model, the second number relationship model, and the third number relationship model to obtain the number relationship map.

9. A message detection device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the message detection method according to any one of claims 1 to 7.

Images