A fraudulent SMS identification and evaluation method and system based on transfer learning

Abstract

The present invention belongs to the technical field of SMS recognition, and provides a method and system for identifying and evaluating fraudulent SMS based on transfer learning. The method includes: obtaining fraudulent SMS, normal SMS, and low-risk SMS to generate a classification data set; generating an instruction data set; using a self-established first training data set to fine-tune the first pre-training model to obtain a fraudulent SMS recognition model; using a self-established second training data set and combining the improved DoRA technology to fine-tune the second pre-training model to obtain a fraudulent SMS cause assessment model; receiving SMS to be processed, inputting the fraudulent SMS recognition model, and obtaining a fraudulent SMS recognition result; when the obtained fraudulent SMS recognition result is a fraudulent type, inputting the SMS to be processed into the fraudulent SMS cause assessment model to obtain an SMS risk cause assessment result for comprehensive evaluation. The present invention comprehensively evaluates fraudulent SMS from three aspects: identifying fraudulent SMS, determining risk levels, and analyzing fraudulent causes.

Description

Technical Field

[0001] The present invention relates to the technical field of text message recognition, and in particular to a method and system for identifying and evaluating fraudulent text messages based on transfer learning. Background Art

[0002] With the acceleration of digital transformation, the increase in the penetration rate of smart phones, and the rapid development of network information technology, fraudulent text messages are increasingly affecting people's lives. Therefore, identifying and filtering fraudulent text messages is of great significance in protecting the security of users' personal information, reducing communication interference, preventing economic losses, and raising social security awareness.

[0003] At present, most of the fraudulent SMS identification methods on the market are based on keyword matching, feature vectors and machine learning methods. Specifically, there are the following types:

[0004] A key dictionary of fraudulent SMS is summarized from historical data and expert experience, and fraudulent SMS are matched and filtered based on the key dictionary. This method is simple and easy to understand and convenient to operate, but the key dictionary summarized by humans often has problems such as incomplete summary and strong subjectivity, resulting in false detection, missed detection, and low recognition rate.

[0005] Collect multiple known fraudulent text messages and normal text messages, obtain the feature vectors of fraudulent text messages and normal text messages mapped to high-dimensional space, and train a binary classification model based on machine learning methods (such as support vector machines) to distinguish fraudulent text messages from normal text messages. This method improves the recognition accuracy to a certain extent, but the model is trained from scratch and lacks prior knowledge of natural language, so the recognition rate is still not high, and it is impossible to analyze the cause of fraud.

[0006] In addition, while collecting the content of fraudulent SMS messages, the user's attribute characteristics are obtained based on the SMS sender's mobile phone number, such as sending time, receiving time, geographic location, operator type, etc. Based on this information, a neural network model (such as LSTM) is established according to the time series dimension to identify fraudulent SMS messages. This method improves the recognition accuracy to a certain extent, but on the one hand, user attribute characteristics are difficult to obtain in actual generation and operation, and the recognition efficiency is low; on the other hand, the neural network model is also trained from scratch, lacking prior knowledge of natural language, and the recognition rate is still not high. At the same time, it is impossible to analyze the causes of fraud.

[0007] The existing technologies, whether based on keyword matching, feature vectors or machine learning methods, have the following shortcomings: 1) The recognition rate is low. The keyword matching method relies on historical summaries and expert experience. The constructed suspicious keyword dictionary for fraudulent SMS messages is often incomplete and highly subjective, with obvious false detections and missed detections. 1) Feature vectors and machine learning methods (such as support vector machines and LSTM) often build models from scratch, rely too much on labeled samples, and have high labor costs. They lack prior knowledge of natural language and model pre-training process, resulting in low recognition rate and weak model generalization. 2) Lack of analysis of fraud causes. Existing technologies only classify fraudulent text messages, but cannot analyze the causes of fraud. In actual application, the model not only needs to identify which text messages are fraudulent, but also determine the risk level of the text messages, such as low risk, medium risk, and high risk. It also needs to give reasons for the analysis from multiple angles, which can correspond to the original text message paragraphs one by one, output comprehensive and comprehensive judgment conclusions and basis for users, and protect user safety. 3) Lack of comprehensive evaluation methods. Existing evaluation methods mainly evaluate the classification effect of fraudulent text messages based on F1 value. There is a lack of comprehensive evaluation methods, that is, to fully consider the classification effect of fraudulent text messages, the risk level determination of text messages, and the accuracy and comprehensiveness of the analysis of fraud causes for comprehensive evaluation, so as to more accurately determine the effect of the model.

[0008] Therefore, it is necessary to provide a method and system for identifying and evaluating fraudulent text messages based on transfer learning to solve the above problems. Summary of the invention

[0009] The present invention aims to provide a method and system for identifying and evaluating fraudulent text messages based on transfer learning, so as to solve the technical problems in the prior art such as the lack of a model pre-training process resulting in a low recognition rate, the inability of the prior method to simultaneously identify fraudulent text messages and analyze the causes of fraud, and thus the inability to achieve comprehensive evaluation. The technical problems to be solved by the present invention are achieved through the following technical solutions.

[0010] The first aspect of the present invention proposes a method for identifying and evaluating fraudulent text messages based on transfer learning, including: obtaining fraudulent text messages, normal text messages, and low-risk text messages, mixing and shuffling the fraudulent text messages, normal text messages, and low-risk text messages to generate a classification data set; performing multi-dimensional risk labeling and multi-angle fraud cause analysis on the fraudulent text messages to obtain fraud cause analysis data, and mixing and shuffling with the collected instruction data to generate an instruction data set; dividing the classification data set into a first training set, a first verification set, and a first test set according to a specified ratio, and fine-tuning a first pre-trained model using the first training data set to obtain a fraudulent text message identification model, wherein, when fine-tuning the first pre-trained model, two types of text message category losses, namely, fraud category losses and business category losses, are calculated simultaneously to assist the first pre-trained model in identifying fraudulent content in point-to-point text messages and fraudulent content in port number text messages, and the following expression is used to calculate the two types of text message category losses:

[0011] = p + r ;

[0012] in, represents the total training loss of the first pre-trained model, p Indicates the losses related to fraud, including the losses related to fraud SMS, low-risk SMS, and normal SMS; r Indicates the loss of service category, including point-to-point SMS and port number SMS service category loss; when min( ) is less than the specified value, the training is stopped and the fraudulent SMS recognition model is obtained;

[0013] The instruction data set is divided into a second training set and a second validation set according to a specified ratio, and the second pre-training model is fine-tuned using the second training data and the improved DoRA technology to obtain a fraudulent SMS cause assessment model; the SMS to be processed is received and input into the fraudulent SMS recognition model to obtain a fraudulent SMS recognition result; when the obtained fraudulent SMS recognition result is a fraudulent type, the SMS to be processed is input into the fraudulent SMS cause assessment model to obtain an SMS risk cause assessment result; and a comprehensive assessment is performed based on the fraudulent SMS recognition result, the risk assessment result and the cause assessment result.

[0014] The second aspect of the present invention proposes a fraudulent text message identification and evaluation system based on transfer learning, which adopts the fraudulent text message identification and evaluation method based on transfer learning described in the first aspect of the present invention. The fraudulent text message identification and evaluation system based on transfer learning includes: an acquisition processing module, which is used to acquire fraudulent text messages, normal text messages, and low-risk text messages, and mix and shuffle the fraudulent text messages, normal text messages, and low-risk text messages to generate a classification data set; a generation processing module, which is used to perform multi-dimensional risk labeling and multi-angle fraud-related cause analysis on the fraudulent text messages to obtain fraud-related cause analysis data, and mix and shuffle the data with the collected instruction data to generate an instruction data set; a first division module, which is used to divide the classification data set into a first training set, a first verification set, and a first test set according to a specified ratio, and use the first training data set to fine-tune the first pre-trained model to obtain a fraudulent text message identification model, wherein, when fine-tuning the first pre-trained model, two types of text message category losses are calculated at the same time, namely, fraudulent category losses and business category losses, to assist the first pre-trained model in identifying fraudulent content in point-to-point text messages and fraudulent content in port number text messages, and the following expression is used to calculate the two types of text message category losses:

[0015] = p + r ;

[0016] in, represents the total training loss of the first pre-trained model, p Indicates the losses related to fraud, including the losses related to fraud SMS, low-risk SMS, and normal SMS; r Indicates the loss of service category, including point-to-point SMS and port number SMS service category loss; when min( ) is less than the specified value, stop training and get the fraudulent SMS recognition model

[0017] ; A second division module is used to divide the instruction data set into a second training set and a second verification set according to a specified ratio, and use the second training data and the improved DoRA technology to fine-tune the second pre-training model to obtain a fraudulent SMS cause assessment model; a first model calculation model is used to receive the SMS to be processed, input the fraudulent SMS recognition model, and obtain the fraudulent SMS recognition result; a second model calculation module is used to input the SMS to be processed into the fraudulent SMS cause assessment model when the obtained fraudulent SMS recognition result is a fraudulent type, and obtain the SMS risk cause assessment result; a comprehensive assessment module performs a comprehensive assessment based on the fraudulent SMS recognition result, the risk assessment result and the cause assessment result.

[0018] The third aspect of the present invention provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in the first aspect of the present invention.

[0019] A fourth aspect of the present invention provides a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in the first aspect of the present invention.

[0020] The embodiments of the present invention include the following advantages:

[0021] Compared with the prior art, the present invention uses a self-established first training data set to fine-tune the first pre-trained model to obtain a fraudulent SMS recognition model, which can accurately identify whether the SMS to be processed is a fraudulent SMS; uses a self-established second training set and combines the improved DoRA technology to fine-tune the second pre-trained model to obtain a fraudulent SMS cause assessment model, which can optimize the model parameters of the fraudulent SMS cause assessment model and can also accurately obtain the SMS risk cause assessment results; based on the fraudulent SMS recognition results, the risk assessment results and the cause assessment results, a comprehensive evaluation is performed, which can comprehensively evaluate the fraudulent SMS from three aspects: identifying fraudulent SMS, determining risk levels, and analyzing fraudulent causes. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flowchart of an example of a fraudulent SMS identification and evaluation method based on transfer learning of the present invention;

[0023] Figure 2 It is a schematic diagram of the principle of the fraudulent SMS identification and evaluation method based on transfer learning of the present invention;

[0024] Figure 3 It is a structural block diagram of the fraudulent SMS identification and evaluation system based on transfer learning of the present invention;

[0025] Figure 4 is a schematic structural diagram of an electronic device embodiment according to the present invention;

[0026] Figure 5 It is a schematic diagram of the structure of a computer-readable medium embodiment according to the present invention. DETAILED DESCRIPTION

[0027] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0028] In view of the above problems, the present invention proposes a method and system for identifying and evaluating fraudulent text messages based on transfer learning. The method uses a self-established first training data set to fine-tune a first pre-trained model to obtain a fraudulent text message identification model, which can accurately identify whether a text message to be processed is a fraudulent text message; a self-established second training set is used, and the second pre-trained model is fine-tuned in combination with an improved DoRA technology to obtain a fraudulent text message cause assessment model, which can optimize the model parameters of the fraudulent text message cause assessment model and can accurately obtain the text message risk cause assessment results; a comprehensive assessment is performed based on the fraudulent text message identification results, the risk assessment results and the cause assessment results, and the fraudulent text messages can be comprehensively evaluated from three aspects: identifying fraudulent text messages, determining risk levels, and analyzing fraudulent causes.

[0029] Example 1

[0030] Refer to the following Figure 1 and Figure 2 , the contents of the present invention will be described in detail.

[0031] Figure 1 This is a flowchart of an example of the method for identifying and evaluating fraudulent text messages based on transfer learning of the present invention. Figure 2 It is a schematic diagram of the principle of the fraudulent text message identification and evaluation method based on transfer learning of the present invention.

[0032] like Figure 1 As shown, in step S101, fraudulent text messages, normal text messages, and low-risk text messages are obtained, and the fraudulent text messages, normal text messages, and low-risk text messages are mixed and shuffled to generate a classified data set.

[0033] Specifically, 20,000 user complaint point-to-point text messages are obtained from the public data of relevant platforms, and fraudulent text messages are manually selected from them. Fraudulent text messages include fraudulent text messages, etc. After data cleaning, 5,000 high-quality fraudulent text messages are obtained. In addition, low-risk text messages and normal text messages are obtained from public channels on the Internet. After data cleaning, 100,000 normal text messages and 10,000 low-risk text messages are obtained.

[0034] For data cleaning, we specifically remove user complaints and only keep the original SMS content. In addition, we also remove emoticons and front-end character encodings in SMS, and SMS content with insufficient natural language semantics, including: SMS with less than 5 characters and the proportion of Chinese characters in SMS less than 50%. SMS with more than 512 characters that the model cannot process are removed.

[0035] By calculating the semantic similarity between each SMS, we can filter or delete SMS. If the semantic similarity between two SMS is greater than 0.8, we randomly keep one of them and delete the other.

[0036] Specifically, the category label of fraudulent text messages is set to 0, the category label of low-risk text messages is set to 1, and the category label of normal text messages is set to 2. The three types of data are mixed and shuffled to generate a "classified data set."

[0037] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0038] Next, in step S102, the fraud-related text messages are subjected to multi-dimensional risk labeling and multi-angle fraud-related cause analysis to obtain fraud-related cause analysis data, which are mixed and shuffled with the collected instruction data to generate an instruction data set.

[0039] In a specific implementation, for example, 5,000 acquired fraudulent SMS data are manually annotated, and the annotated dimensions include risk level (low risk, medium risk, high risk), multi-angle analysis of fraudulent reasons, and original SMS paragraphs corresponding to the fraudulent reasons. For annotation, for example, for a fraudulent SMS, the security risk level of the SMS, i.e., risk_level, is annotated, such as multiple risk levels, including low risk, medium risk, and high risk. Secondly, multiple possible risk factors, i.e., risk_factors, are annotated. In addition, the risk reason and the text fragments in the original SMS associated with each risk reason are annotated for each risk factor.

[0040] In an optional implementation, for example, the 5,000 acquired fraudulent text message data are manually labeled, and the labeled dimensions include risk level, multi-angle analysis of fraudulent causes, and original text message paragraphs corresponding to the fraudulent causes. For labeling, for example, for a fraudulent text message, the security risk level of the text message, i.e., risk_level, is labeled, such as multiple risk levels, including low risk, medium risk, and high risk. Secondly, multiple possible risk factors, i.e., risk_factors, are labeled. In addition, for each risk factor, the risk cause, the text fragment associated with each risk cause in the original text message, and the text position are labeled. In addition, the number of risk factors and whether it exceeds a specific number (for example, three, four, five, etc.) are marked.

[0041] Next, we collected 30,000 open-source general instruction data (including questions and answers, summaries, translations, thought chains, etc.) from public channels on the Internet, and mixed them with the 5,000 fraud-related cause analysis data manually labeled by the above implementation method to generate an "instruction data set."

[0042] In the process of multi-angle fraud analysis and annotation, the following types are specifically annotated: ticket refund and change, personal insurance closure, false notification, express damage compensation, etc. The annotation ratio of these types is roughly consistent with the actual case ratio, for example, 1.5:1:0.9:0.3, to ensure the robustness of the model and prevent the model from overfitting. The original text used for annotation is selected according to the calculated annotation ratio.

[0043] In addition, it also marks variant words, risky URLs, risky apps, fraudulent phone calls, etc. These types of elements are strongly related to fraud, and they need to be marked as long as the above information appears in the text messages or related texts.

[0044] In the original SMS paragraph annotations corresponding to the reasons for fraud: multiple risk reasons can be marked for the same original paragraph; the same risk reason can be marked for different original paragraphs; WeChat, QQ, risky URLs, risky APPs, fraudulent phone calls and other strongly fraud-related elements all need to be accurately marked in the original paragraphs.

[0045] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0046] Next, in step S103, the classification data set is divided into a first training set, a first validation set, and a first test set according to a specified ratio, and the first pre-trained model is fine-tuned using the first training data set to obtain a fraudulent SMS recognition model. When fine-tuning the first pre-trained model, two types of SMS category losses are calculated at the same time, namely, the fraudulent category loss and the business category loss, to assist the first pre-trained model in identifying the fraudulent content in the point-to-point SMS and the fraudulent content in the port number SMS. The following expression is used to calculate the two types of SMS category losses:

[0047] = p + r ;

[0048] in, represents the total training loss of the first pre-trained model, p Indicates the losses related to fraud, including the losses related to fraud SMS, low-risk SMS (specifically SMS with lower risk than fraud SMS), and normal SMS; r Indicates the loss of service category, including point-to-point SMS and port number SMS service category loss; when min( ) is less than the specified value, the training is stopped and the fraudulent SMS recognition model is obtained.

[0049] Specifically, the classification data set is divided into a first training set, a first validation set, and a first test set in a specified ratio (preferably 8:1:1).

[0050] Optionally, the ratio is specified as 8:1:1, 6:2:2, or 7:2:1. Multiple models can be trained according to different division ratios, and the model with the best effect (for example, a model accuracy higher than 92%) is selected as the final model, i.e., the fraudulent SMS identification model.

[0051] The Chinese BERT is used as the base of the first pre-trained model, and the first pre-trained model is fine-tuned. The fraudulent SMS recognition model obtained after fine-tuning is recorded as "BERT-FineTurn". In essence, the first pre-trained model is used as the base, and the knowledge contained in the first training set is transferred to the weights of the first pre-trained model using the transfer learning method. The fraudulent SMS recognition model has the ability to classify fraudulent SMS.

[0052] In the process of fine-tuning the first pre-trained model, the existing fine-tuning method was optimized based on the characteristics of SMS text. The specific process is as follows:

[0053] SMS texts are divided into point-to-point SMS and port number SMS. Point-to-point SMS refers to SMS sent from one person to another. Port number SMS refers to SMS sent by an enterprise through the same port number after registering a port with an operator. Unlike point-to-point SMS, the content of port number SMS mostly contains information such as website addresses and phone numbers.

[0054] Randomly extract 30% of the point-to-point text messages from the first training set, add special characters (such as [ddd]) at the beginning of the text message content, keep the remaining 70% of the point-to-point text messages unchanged, and add special characters (such as [ddd]) to the vocabulary of the first pre-trained model. Randomly extract 50% of the port number text messages from the first training set, add special characters (such as [dkh]) at the beginning of the text message content, keep the remaining 50% of the port number text messages unchanged, and add special characters (such as [dkh]) to the vocabulary of the first pre-trained model. This helps the first pre-trained model to more accurately distinguish between point-to-point text messages and port number text messages.

[0055] For all the first training set data, special characters (such as "$") are added before and after the URL contained in the SMS content, and special characters (such as "&") are added before and after the phone number contained in the SMS content, so as to assist the first pre-trained model to more accurately identify the semantics of the URL and phone number.

[0056] When fine-tuning the first pre-trained model, two types of SMS category losses are calculated at the same time, namely, fraud category losses (fraud SMS, low-risk SMS, normal SMS) and business category losses (point-to-point SMS, port number SMS), to assist the first pre-trained model to more accurately identify the fraudulent content in point-to-point SMS and the fraudulent content in port number SMS, to avoid the model confusing the two and causing overfitting. The total loss calculation formula is:

[0057] = p + r ;

[0058] in, represents the total training loss of the first pre-trained model, p Indicates the losses related to fraud, including the losses related to fraud SMS, low-risk SMS, and normal SMS; r Indicates the loss of service category, including point-to-point SMS and port number SMS service category loss; when min( ) is less than the specified value, the training is stopped and the fraudulent SMS recognition model is obtained.

[0059] When min( ) is less than a specified value, the training is stopped to obtain a fraudulent SMS recognition model, where the specified value is, for example, 0.0001 to 0.0008.

[0060] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0061] Next, in step S104, the instruction data set is divided into a second training set and a second verification set according to a specified ratio, and the second training data is used to fine-tune the second pre-training model in combination with the improved DoRA technology to obtain a fraudulent SMS cause assessment model.

[0062] Specifically, the instruction data set is divided into a second training set and a second validation set according to a specified ratio (preferably 20:1).

[0063] Optionally, the instruction data set is divided into ratios of 100:5:5, 100:3:3, and 100:10:10. Multiple models can be trained according to different division ratios, and the model with the best effect (for example, the model accuracy is higher than 92%) is selected as the final model, that is, the fraudulent SMS cause assessment model.

[0064] The Chinese language large model llama2 is selected as the base of the second pre-trained model, and the second training data is used, and the second pre-trained model is fine-tuned in combination with the efficient fine-tuning technology DoRA. Specifically, the second pre-trained model is used as the base, and the transfer learning method is used to transfer the knowledge contained in the second training set to the weights of the second pre-trained model.

[0065] The fine-tuning technique DoRA is used to fine-tune the second pre-trained model.

[0066] Specifically, when the weight parameter of the second pre-trained model is W 0 When , the weight parameter after fine-tuning is W, and the adjustment parameter during training is , the following expression is formed:

[0067] ;

[0068] According to the improved DoRA technology, the adjustment parameter Decomposed into the reduced dimension matrix H and the increased dimension matrix K, the following is formed:

[0069] ;

[0070] Among them, W 0 represents the weight parameters of the second pre-trained model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, , k is the number of columns of the matrix; r is the rank, which is a priori parameter and ,During the training process, H and K are trainable parameters, and the others are prior parameters and fixed parameters.

[0071] Further comprising: decomposing the weight parameter W into amplitude and direction, and adjusting the formula as follows:

[0072] ;

[0073] Where m represents the amplitude, , the initial direction is , the updated direction is , c represents W 0 The norm type, W 0 represents the weight parameters of the second pre-trained model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, ;

[0074] During the model forward training process, W 0 and will all be multiplied by the same input x, namely:

[0075] ;

[0076] Where L is the model output; m represents the amplitude, , the initial direction is , the updated direction is , c represents W 0 The norm type, W 0 represents the weight parameters of the second pre-trained model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, .

[0077] In order to enable the second pre-trained model to learn more refined features and speed up the model convergence, in the experimental environment, neither a fixed learning rate nor the same learning rate is used for .

[0078] The inverse time decay learning rate is set for the dimension-raising matrix H, and its update formula is:

[0079] ;

[0080] in, Represents the learning rate after the dimension-raising matrix H is updated; LR H represents the initial learning rate of the dimension-raising matrix H; represents the decay exponent, rstep represents the total number of training steps of the second pre-training model, and epoch represents the total number of training rounds of the second pre-training model;

[0081] The polynomial decay learning rate of the specified number of times is set for the dimension reduction matrix K, and its update formula is:

[0082] ;

[0083] in, represents the learning rate after the dimension reduction matrix K is updated; LR start K represents the initial learning rate of the dimension reduction matrix K, LR end K represents the termination learning rate of the dimension reduction matrix K, rstep represents the total number of training steps of the second pre-training model, epoch represents the total number of training rounds of the second pre-training model, and t is the polynomial degree.

[0084] The specified number of times is 2 to 5.

[0085] When L' is used to represent the true answer, the condition for stopping training is that the difference between the true answer and the model output is the smallest, expressed as:

[0086] min(L'-L);

[0087] When min(L'-L) is less than the specified value, the training is stopped and a fraudulent SMS cause assessment model is obtained. The fraudulent SMS cause assessment model can analyze variant words, risky URLs, fraudulent numbers, misleading information and other contents in the fraudulent SMS to obtain analysis results.

[0088] Specifically, determine the loss value (specified value) at which the model terminates training, which is usually in the range of 10 -4 to 10 -3 By cross-validating the model effect, the loss value for terminating the fraud cause analysis model training is set to 0.0001~0.0010, preferably 0.0005.

[0089] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0090] Next, in step S105, the SMS to be processed is received, the fraudulent SMS identification model is input, and the fraudulent SMS identification result is obtained.

[0091] In a specific implementation, a text message to be processed is received (for example, "Wow, [Betfair Group] sincerely invites you to register with your mobile phone number and get 28 yuan, and new members are rewarded with a charge of 50 and get 50 yuan. Limited places are available at 22778890.com / ?intr=1330826.ukK"), the text message to be processed is input into a fraudulent text message recognition model, and {\"risk_level\": \"Medium risk\", \"risk_factors\":[{\"relate_slice\": \"Register with your mobile phone number and get 28 yuan\",\"reason\": \"1*\"}, {\"relate_slice\": \"22778890.com / ?intr=1330826.ukK\", \"reason\": \"Risk URL\"}] is output.

[0092] Specifically, the model output is in JSON format, for example, and other explanatory content does not need to be output.

[0093] According to the model output, the fraudulent SMS identification results include risk level, whether the number of risk factors exceeds a certain number, etc. For example, the fraudulent SMS identification results are fraudulent type, medium risk, and more than three risk factors.

[0094] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0095] Next, in step S106, when the obtained fraudulent SMS identification result is a fraudulent type, the SMS to be processed is input into a fraudulent SMS cause assessment model to obtain an SMS risk cause assessment result.

[0096] In a specific implementation, when the obtained fraudulent SMS identification result is a fraudulent type, the SMS to be processed is input into a fraudulent SMS cause assessment model to obtain an SMS risk cause assessment result.

[0097] In another specific implementation, when the fraudulent SMS identification result is a fraudulent type, high risk, and more than three risk factors, the SMS to be processed is input into the fraudulent SMS cause assessment model to obtain the SMS risk cause assessment result. The SMS risk assessment result includes the risk level, each risk factor, the risk cause corresponding to each risk factor, the position of each risk cause in the SMS to be processed and its corresponding original text.

[0098] In another specific implementation, when the obtained fraudulent SMS identification result is a fraudulent type, high risk and the risk factor includes a specified risk, the SMS to be processed and the obtained fraudulent SMS identification result are input into a fraudulent SMS cause assessment model to obtain an SMS risk cause assessment result.

[0099] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0100] Next, in step S107, a comprehensive assessment is performed based on the fraudulent SMS identification result, the risk assessment result and the cause assessment result.

[0101] Specifically, the fraudulent text message identification result, the risk assessment result and the cause assessment result are weighted and comprehensively calculated to obtain a comprehensive score.

[0102] In a specific implementation, a neural network algorithm is used to establish a comprehensive evaluation model, and text messages marked with fraud scores and containing fraudulent text message identification results and risk assessment reasons are used to establish a training data set to train the comprehensive evaluation model and obtain a trained comprehensive evaluation model.

[0103] The fraudulent text message identification result, the risk assessment result and the cause assessment result obtained above are input into the comprehensive assessment model to obtain a score, namely the comprehensive assessment score.

[0104] It should be noted that the present invention fully considers the classification effect of fraudulent text messages, the risk level determination of text messages, and the accuracy and comprehensiveness of the analysis of the causes of fraud to establish a comprehensive evaluation method for identifying and analyzing fraudulent text messages.

[0105] A 5-point comparison is used to manually score and judge the effectiveness of the fraudulent text message identification and cause analysis model. Based on the comprehensive evaluation score calculated above, a 5-point comparison is used to determine the corresponding risk.

[0106] Specifically, 5 points means that the category division is correct, the risk level is correct, the analysis of the causes of fraud is comprehensive and accurate, and the correspondence between the causes of fraud and the original paragraphs of the text message is correct; 4 points means that the category division is correct, the risk level is basically correct (allowing medium risk to be identified as high risk, or high risk to be identified as medium risk), the analysis of the causes of fraud is relatively comprehensive (allowing individual omissions), the analysis of the causes of fraud is accurate, and the correspondence between the causes of fraud and the original paragraphs of the text message is correct; 3 points means that the category division is correct, the risk level is basically correct (allowing medium risk to be identified as high risk, or high risk to be identified as medium risk), the analysis of the causes of fraud is relatively comprehensive 2 points means the category division is correct, the risk level is basically correct (medium risk is allowed to be identified as high risk, or high risk is allowed to be identified as medium risk), the analysis of the causes of fraud is (partial missing is allowed), the analysis of the causes of fraud is basically accurate (partial errors are allowed), and the correspondence between the causes of fraud and the original paragraphs of the text message is correct; 1 point means the category division is wrong, or the analysis of the causes of fraud is completely missing, or the analysis of the causes of fraud is completely wrong, or the correspondence between the causes of fraud and the original paragraphs of the text message is completely wrong.

[0107] In general, a comprehensive score of 4 points or above can be considered correct and usable, and a comprehensive score of 3 points or above can be considered basically correct and usable.

[0108] Based on the calculated comprehensive evaluation points and the evaluation contents corresponding to the above points, the comprehensive evaluation results are determined.

[0109] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0110] In addition, the drawings are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the drawings do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0111] Compared with the prior art, the present invention uses a self-established first training data set to fine-tune the first pre-trained model to obtain a fraudulent SMS recognition model, which can accurately identify whether the SMS to be processed is a fraudulent SMS; uses a self-established second training set and combines the DoRA technology to fine-tune the second pre-trained model to obtain a fraudulent SMS cause assessment model, which can optimize the model parameters of the fraudulent SMS cause assessment model and can also accurately obtain the SMS risk cause assessment results; based on the fraudulent SMS recognition results, the risk assessment results and the cause assessment results, a comprehensive evaluation is performed, which can comprehensively evaluate the fraudulent SMS from three aspects: identifying fraudulent SMS, determining risk levels, and analyzing fraudulent causes.

[0112] Example 2

[0113] The following is a system embodiment of the present invention, which can be used to implement the method embodiment of the present invention. For details not disclosed in the system embodiment of the present invention, please refer to the method embodiment of the present invention.

[0114] Figure 3 It is a structural diagram of an example of a fraudulent text message identification and evaluation system based on transfer learning according to the present invention.

[0115] Reference Figure 3 The second aspect of the present disclosure provides a fraudulent text message identification and evaluation system 300 based on transfer learning, which adopts the fraudulent text message identification and evaluation method described in the first aspect of the present invention.

[0116] Specifically, the fraudulent SMS identification and evaluation system 300 based on transfer learning includes an acquisition processing module 310, a generation processing module 320, a first division module 330, a second division module 340, a first model calculation module 350, a second model calculation module 360 ​​and a comprehensive evaluation module 370.

[0117] In a specific implementation, the acquisition processing module 310 is used to obtain fraudulent text messages, normal text messages, and low-risk text messages, and mix and shuffle the fraudulent text messages, normal text messages, and low-risk text messages to generate a classification data set; the generation processing module 320 is used to perform multi-dimensional risk labeling and multi-angle fraud-related cause analysis on the fraudulent text messages, obtain fraud-related cause analysis data, and mix and shuffle with the collected instruction data to generate an instruction data set. The first division module 330 is used to divide the classification data set into a first training set, a first verification set, and a first test set according to a specified ratio, and use the first training data set to fine-tune the first pre-trained model to obtain a fraudulent text message recognition model. The second division module 340 is used to divide the instruction data set into a second training set and a second verification set according to a specified ratio, use the second training data, and combine the DoRA technology to fine-tune the second pre-trained model to obtain a fraudulent text message cause assessment model. The first model calculation model 350 is used to receive text messages to be processed, input the fraudulent text message recognition model, and obtain fraudulent text message recognition results. The second model calculation module 360 ​​is used to input the to-be-processed SMS into the fraudulent SMS cause assessment model to obtain the SMS risk cause assessment result when the fraudulent SMS identification result is a fraudulent type. The comprehensive assessment module 370 performs a comprehensive assessment based on the fraudulent SMS identification result, the risk assessment result and the cause assessment result.

[0118] According to an optional implementation manner, the instruction data set is divided into a second training set, a second verification set, and a second test set in a specified ratio, and the second training data is used to fine-tune the second pre-trained model in combination with the improved DoRA technology to obtain a fraudulent SMS cause assessment model.

[0119] Based on the second pre-trained model, a transfer learning method is used to transfer the knowledge contained in the second training set to the weights of the second pre-trained model.

[0120] When the weight parameter of the second pre-trained model is , the weight parameter after fine-tuning is , and the adjustment parameter during training is , the following expression is formed:

[0121] When the weight parameter of the second pre-trained model is W 0 When , the weight parameter after fine-tuning is W, and the adjustment parameter during training is , the following expression is formed:

[0122] ;

[0123] According to the improved DoRA technology, the adjustment parameter Decomposed into the reduced dimension matrix H and the increased dimension matrix K, the following is formed:

[0124] ;

[0125] Among them, W 0 represents the weight parameters of the second pre-trained model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, , k is the number of columns of the matrix; r is the rank, which is a priori parameter and ,During the training process, H and K are trainable parameters.

[0126] According to an optional implementation, the weight parameter W is decomposed into amplitude and direction, and the adjustment formula is:

[0127] ;

[0128] Where m represents the amplitude, , the initial direction is , the updated direction is , c represents W 0 The norm type, W 0 represents the weight parameters of the second pre-trained model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, ;

[0129] During the model forward training process, W 0 and will all be multiplied by the same input x, namely:

[0130] ;

[0131] Where L is the model output; m represents the amplitude, , the initial direction is , the updated direction is , c represents W 0 The norm type, W 0 represents the weight parameters of the second pre-trained model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, ;

[0132] When L' is used to represent the true answer, the condition for stopping training is that the difference between the true answer and the model output is the smallest, expressed as:

[0133] min(L'-L);

[0134] When min(L'-L) is less than the specified value, the training is stopped and the fraudulent SMS cause assessment model is obtained.

[0135] According to an optional implementation, an inverse time decay learning rate is set for the dimension-raising matrix H, and its update formula is:

[0136] ;

[0137] in, Represents the learning rate after the dimension-raising matrix H is updated; LR H Represents the initial learning rate of the dimension-raising matrix H; represents the decay exponent, rstep represents the total number of training steps of the second pre-training model, and epoch represents the total number of training rounds of the second pre-training model;

[0138] According to an optional implementation manner, a polynomial decay learning rate of a specified order is set for the dimension reduction matrix K, and its update formula is:

[0139] ;

[0140] in, represents the learning rate after the dimension reduction matrix K is updated; LR start K represents the initial learning rate of the dimension reduction matrix K, LR end K represents the termination learning rate of the dimension reduction matrix K, rstep represents the total number of training steps of the second pre-training model, epoch represents the total number of training rounds of the second pre-training model, and t is the polynomial degree; the specified number is 2 to 5.

[0141] According to an optional implementation manner, the classification data set is divided into a first training set, a first validation set, and a first test set at a ratio of 8:1:1. The classification data set is divided into a second training set and a second validation set at a ratio of 20:1.

[0142] The fraud-related text messages are subjected to multi-dimensional risk labeling and multi-angle fraud-related cause analysis to obtain fraud-related cause analysis data, including: multi-dimensional risk labeling includes: low risk, medium risk, and high risk labeling.

[0143] The multi-angle analysis of the causes of fraud includes the following: closing personal insurance, refunding and changing air tickets, etc.

[0144] Original SMS paragraph annotation corresponding to the fraud reason: Mark the text position in the original SMS corresponding to each fraud reason.

[0145] Compared with the prior art, the present invention uses a self-established first training data set to fine-tune the first pre-trained model to obtain a fraudulent SMS recognition model, which can accurately identify whether the SMS to be processed is a fraudulent SMS; uses a self-established second training set and combines the improved DoRA technology to fine-tune the second pre-trained model to obtain a fraudulent SMS cause assessment model, which can optimize the model parameters of the fraudulent SMS cause assessment model and can also accurately obtain the SMS risk cause assessment results; based on the fraudulent SMS recognition results, the risk assessment results and the cause assessment results, a comprehensive evaluation is performed, which can comprehensively evaluate the fraudulent SMS from three aspects: identifying fraudulent SMS, determining risk levels, and analyzing fraudulent causes.

[0146] Figure 4 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

[0147] like Figure 4 As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0148] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0149] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0150] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0151] It should be understood that Figure 4 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0152] Through the above description of the implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by combining software with necessary hardware. Figure 5 As shown, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of commands to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the embodiment of the present invention.

[0153] The software product may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0154] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, device, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0155] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0156] The computer-readable medium carries one or more programs (eg, computer-executable programs). When the one or more programs are executed by a device, the computer-readable medium implements the method of the present disclosure.

[0157] Those skilled in the art will appreciate that the above modules can be distributed in the device according to the description of the embodiment, or can be changed accordingly and only used in one or more devices different from the embodiment. The modules of the above embodiments can be combined into one module, or further divided into multiple sub-modules.

[0158] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the exemplary embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several commands to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiment of the present invention.

[0159] The exemplary embodiments of the present invention are specifically shown and described above. It should be understood that the present invention is not limited to the detailed structure, configuration or implementation method described herein; on the contrary, the present invention is intended to cover various modifications and equivalent configurations included in the spirit and scope of the appended claims.

Claims

1. A fraudulent SMS identification and evaluation method based on transfer learning, characterized in that: include: Obtain fraudulent text messages, normal text messages, and harassing text messages, mix and shuffle the fraudulent text messages, normal text messages, and harassing text messages, and generate a classified data set; Perform multi-dimensional risk labeling and multi-angle fraud-related cause analysis on the fraud-related text messages to obtain fraud-related cause analysis data, which is mixed and shuffled with the collected instruction data to generate an instruction data set; The classification data set is divided into a first training set, a first validation set, and a first test set according to a specified ratio. The first pre-training model is fine-tuned using the first training data set to obtain a fraudulent SMS recognition model. When fine-tuning the first pre-training model, two types of SMS category losses are calculated simultaneously, namely, fraudulent category losses and business category losses, to assist the first pre-training model in identifying fraudulent content in point-to-point SMS and fraudulent content in port number SMS. The following expression is used to calculate the two types of SMS category losses: ； in, represents the total training loss of the first pre-trained model, Indicates the losses related to fraud, including the losses related to fraudulent SMS, harassing SMS, and normal SMS; Indicates the loss of service category, including point-to-point SMS and port number SMS service category loss; When it is less than the specified value, the training is stopped and the fraudulent SMS recognition model is obtained; The instruction data set is divided into a second training set and a second verification set according to a specified ratio. The second training data is used, and the second pre-training model is fine-tuned in combination with the improved DoRA technology to obtain a fraudulent SMS cause assessment model, which specifically includes: using the second pre-training model as the base, using the transfer learning method to transfer the knowledge contained in the second training set to the weight of the second pre-training model; when the weight parameter of the second pre-training model is W0, the weight parameter after fine-tuning is W, and the adjustment parameter in the training process is , the following expression is formed: ; According to the improved DoRA technology, the adjustment parameter Decomposed into the reduced dimension matrix H and the increased dimension matrix K, the following is formed: ; Where W0 represents the weight parameter of the second pre-training model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, , k is the number of columns of the matrix; r is the rank, which is a priori parameter and , during the training process, H and K are trainable parameters; the weight parameter W is decomposed into amplitude and direction, and the adjustment formula is: ; Where m represents the amplitude, , the initial direction is , the updated direction is , c represents the norm type of W0, W0 represents the weight parameter of the second pre-training model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, ; During the forward training of the model, W0 and will all be multiplied by the same input x, namely: ; Where L is the model output; m represents the amplitude, , the initial direction is , the updated direction is , c represents the norm type of W0, W0 represents the weight parameter of the second pre-training model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, ; When L' is used to represent the true answer, the condition for stopping training is that the difference between the true answer and the model output is the smallest, expressed as: ; when When it is less than the specified value, the training is stopped and the fraudulent SMS cause assessment model is obtained; Receive the SMS to be processed, input the fraudulent SMS identification model, and obtain the fraudulent SMS identification result; When the fraudulent SMS identification result is a fraudulent type, the SMS to be processed is input into a fraudulent SMS cause assessment model to obtain a risk assessment result and a cause assessment result; A comprehensive assessment is conducted based on the fraudulent text message identification results, the risk assessment results and the cause assessment results.

2. According to the method for identifying and evaluating fraudulent text messages based on transfer learning in claim 1, it is characterized in that: Further including: The inverse time decay learning rate is set for the dimension-raising matrix H, and its update formula is: ; in, represents the learning rate after the dimension-raising matrix H is updated; IR H Represents the initial learning rate of the dimension-raising matrix H; Represents the decay exponent, rstep represents the total number of training steps of the second pre-training model, and epoch represents the total number of training rounds of the second pre-training model.

3. The fraudulent SMS identification and evaluation method based on transfer learning according to claim 1 is characterized in that: Further including: The polynomial decay learning rate of the specified number of times is set for the dimension reduction matrix K, and its update formula is: ； in, represents the learning rate after the dimension reduction matrix K is updated; IR start K represents the initial learning rate of the dimension reduction matrix K, IR end K represents the termination learning rate of the dimension reduction matrix K, rstep represents the total number of training steps of the second pre-training model, epoch represents the total number of training rounds of the second pre-training model, and t is the polynomial degree; The specified number t is 2-5.

4. The fraudulent SMS identification and evaluation method based on transfer learning according to claim 1 is characterized in that: include: The classification data set is divided into a first training set, a first validation set, and a first test set according to an 8:1:1 ratio.

5. The fraudulent SMS identification and evaluation method based on transfer learning according to claim 1 is characterized in that: include: The classification data set is divided into a second training set and a second validation set at a ratio of 20:

1.

6. The fraudulent SMS identification and evaluation method based on transfer learning according to claim 1 is characterized in that: The fraudulent SMS is labeled with multi-dimensional risks and analyzed for fraudulent reasons from multiple angles to obtain fraudulent reason analysis data, including: Multi-dimensional risk labeling includes: low risk, medium risk, and high risk labeling; The multi-angle analysis of the reasons for fraud includes the following: closing personal insurance, flight refunds and changes, false investment and financial management, profit inducement, pornographic inducement, gambling, containing variant characters, providing illegal services, threats and intimidation, false notifications, inducing to add private WeChat, inducing to add private QQ, inducing to call back, risky URLs, risky APPs, fraudulent calls, rebates for fake orders, impersonating public security, procuratorial and judicial organs, impersonating acquaintances, impersonating superiors, impersonating e-commerce customer service, false loans, false collection, false certificate processing, express damage compensation, false credit card agency, extortion; Original SMS paragraph annotation corresponding to the fraud reason: Mark the text position in the original SMS corresponding to each fraud reason.

7. A fraudulent SMS identification and evaluation system based on transfer learning, characterized in that: The fraudulent text message identification and evaluation method based on transfer learning according to claim 1 is adopted, and the fraudulent text message identification and evaluation system based on transfer learning comprises: An acquisition processing module is used to acquire fraudulent text messages, normal text messages, and harassing text messages, mix and shuffle the fraudulent text messages, normal text messages, and harassing text messages to generate a classified data set; A generation processing module is used to perform multi-dimensional risk labeling and multi-angle fraud-related cause analysis on the fraud-related text messages, obtain fraud-related cause analysis data, mix and shuffle them with the collected instruction data, and generate an instruction data set; The first partitioning module is used to divide the classification data set into a first training set, a first validation set, and a first test set according to a specified ratio, and fine-tune the first pre-trained model using the first training data set to obtain a fraudulent SMS recognition model, wherein, when fine-tuning the first pre-trained model, two types of SMS category losses are calculated simultaneously, namely, fraudulent category losses and business category losses, to assist the first pre-trained model in identifying fraudulent content in point-to-point SMS and fraudulent content in port number SMS, and the following expression is used to calculate the two types of SMS category losses: ； in, represents the total training loss of the first pre-trained model, Indicates the losses related to fraud, including the losses related to fraudulent SMS, harassing SMS, and normal SMS; Indicates the loss of service category, including point-to-point SMS and port number SMS service category loss; When it is less than the specified value, the training is stopped and the fraudulent SMS recognition model is obtained; The second division module is used to divide the instruction data set into a second training set and a second verification set according to a specified ratio, and use the second training data and the improved DoRA technology to fine-tune the second pre-trained model to obtain a fraudulent SMS cause assessment model, which specifically includes: using the second pre-trained model as the base, using the transfer learning method to transfer the knowledge contained in the second training set to the weight of the second pre-trained model; when the weight parameter of the second pre-trained model is W0, the weight parameter after fine-tuning is W, and the adjustment parameter in the training process is , the following expression is formed: ; According to the improved DoRA technology, the adjustment parameter Decomposed into the reduced dimension matrix H and the increased dimension matrix K, the following is formed: ; Where W0 represents the weight parameter of the second pre-training model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, , k is the number of columns of the matrix; r is the rank, which is a priori parameter and , during the training process, H and K are trainable parameters; the weight parameter W is decomposed into amplitude and direction, and the adjustment formula is: ; Where m represents the amplitude, , the initial direction is , the updated direction is , c represents the norm type of W0, W0 represents the weight parameter of the second pre-training model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, ; During the forward training of the model, W0 and will all be multiplied by the same input x, namely: ; Where L is the model output; m represents the amplitude, , the initial direction is , the updated direction is , c represents the norm type of W0, W0 represents the weight parameter of the second pre-training model, , d is the number of rows in the matrix, k is the number of columns in the matrix; H represents a dimension-raising matrix, initialized with an all-zero matrix, , where d is the number of rows in the matrix; K represents the dimension reduction matrix, initialized with a random Gaussian distribution, ; When L' is used to represent the true answer, the condition for stopping training is that the difference between the true answer and the model output is the smallest, expressed as: ; when When it is less than the specified value, the training is stopped and the fraudulent SMS cause assessment model is obtained; Receive the SMS to be processed, input the fraudulent SMS identification model, and obtain the fraudulent SMS identification result; When the fraudulent SMS identification result is a fraudulent type, the SMS to be processed is input into a fraudulent SMS cause assessment model to obtain a risk assessment result and a cause assessment result; A comprehensive assessment is conducted based on the fraudulent text message identification results, the risk assessment results and the cause assessment results.

Images