Mail risk early warning system based on hierarchical graph neural network and LSTM

Abstract

The application discloses a mail risk early warning system based on a hierarchical graph neural network and an LSTM, and comprises a hierarchical graph construction module, which is used for constructing a "mail city transfer center - network point" hierarchical graph; a mail data import module, which is used for importing mail order data, mail image recognition data and historical mail data in a database at the mail city transfer center and the network point and performing a pretreatment operation; a mail feature extraction module, which is used for performing feature extraction on the mail data; a node feature updating module, which is used for updating the node features; and a node risk early warning module, which is used for performing risk category probability prediction on the nodes in the hierarchical graph, and when the nodes are in a high or high category, the system starts a safety early warning prompt to remind the staff to strengthen management and control. The application introduces the hierarchical graph neural network for the first time to predict the node risk on the mail link from a global perspective, capture the mutual influence relationship on the mail link node, and improve the accuracy of the node risk prediction.

Description

Technical Field

[0001] This invention relates to the technical field of email link risk warning, and in particular to an email risk warning system based on hierarchical graph neural networks and LSTM. Background Technology

[0002] With the rise of e-commerce platforms, mail transportation has rapidly developed as a major mode of goods transport. However, behind the rapid growth of mail services, risk supervision and assessment methods have lagged behind. Due to its low cost, high concealment, and wide geographical coverage, some criminals may use this channel to transport illegal goods, which not only threatens urban traffic and operational safety but also becomes an unstable factor in social security management, increasing urban security risks.

[0003] Currently, domestic methods for identifying mail risks mainly fall into two categories: one is to detect prohibited items through manual inspection and verification. Specific measures include mail registration with real names, inspection upon receipt and delivery, and security screening via X-ray machines. This method relies on the experience and vigilance of security personnel, manually verifying mail information and package contents to prevent potential risks. However, the efficiency and accuracy of manual inspection are often limited by personnel allocation, workload, and individual differences, making it prone to missed or false detections due to fatigue.

[0004] Another approach involves developing intelligent detection technology for X-ray security images, using image processing and recognition techniques as auxiliary means. This method utilizes advanced computer vision algorithms to perform X-ray scanning and image analysis on mail packages, assisting security personnel in identifying contraband and dangerous items. Although this technology improves detection efficiency and accuracy to some extent, its effectiveness is still limited by algorithm performance and equipment configuration.

[0005] The aforementioned research and applications primarily focus on email screening at a single node, lacking a global perspective and systematic risk assessment capabilities. This single-point screening model has significant limitations when facing massive and diverse email volumes. Due to the lack of collaboration and information sharing between nodes, the screening effect is often localized and one-sided. Furthermore, existing screening technologies may struggle to maintain efficiency and accuracy when faced with complex and ever-changing email content and constantly evolving methods of disguising prohibited items, leading to certain security risks. To improve the effectiveness of email risk identification, a more comprehensive and systematic solution is urgently needed, capable of integrating and analyzing email information from multiple nodes and channels globally, achieving cross-node collaborative screening and risk warning. This requires not only technological innovation and breakthroughs but also consideration of real-time information sharing and comprehensive utilization in system design and implementation, thereby establishing a more robust and reliable email risk warning system. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings and deficiencies of existing technologies and provide an email risk early warning system based on hierarchical graph neural networks and LSTM. This system is the first to introduce hierarchical graph neural networks into the field of email link risk early warning, constructing a hierarchical graph of "email city transit center - outlets" to dynamically mine potential risks at nodes from a global perspective. Through this global perspective, the system can comprehensively consider the interdependencies between various nodes in the email transit process, effectively identify and analyze the interactive impact of upstream and downstream nodes, thereby improving the accuracy and reliability of risk prediction. Simultaneously, the system also combines email order data mining technology and X-ray security image intelligent detection technology, achieving a more comprehensive email risk assessment through the fusion analysis of multi-source data.

[0007] To achieve the above objectives, the technical solution provided by this invention is: an email risk warning system based on hierarchical graph neural networks and LSTM, comprising:

[0008] The hierarchical graph construction module is used to construct a hierarchical graph of "mail city transfer center - outlet". It abstracts the mail city transfer centers and outlets that mail passes through during transportation into nodes, constructs edges between adjacent nodes to obtain a graph structure, and obtains a hierarchical graph structure through layering, thereby modeling the complex spatiotemporal dependencies between nodes at different granularities.

[0009] The email data import module is used to import three types of data: email order data from email city transfer centers and outlets, email image recognition data, and historical email data from the database. It also performs preprocessing operations on these three types of data, including deleting outliers and redundant data, to obtain preprocessed email data.

[0010] The email feature extraction module is used to extract features from the email data preprocessed by the email data import module. It uses an LSTM network to perform encoding and decoding operations on the email data, automatically learns the key features in the email data, realizes dimensionality reduction and feature extraction of email data, and obtains node features.

[0011] The node feature update module is used to update the node features obtained by the email feature extraction module. It uses a hierarchical graph neural network and attention mechanism to perform message aggregation and representation update of nodes between and within layers, and obtains the final feature representation of nodes in the hierarchical graph.

[0012] The node risk warning module is used to predict the probability of risk categories for nodes in the hierarchical graph. The input is the final feature representation of the node obtained by the node feature update module. The risk classification of the node is performed by a neural network consisting of fully connected layers and a sigmoid activation function. The risk categories are set to five categories: low, slightly low, medium, slightly high, and high. When a node is in the slightly high or high category, the system will activate a safety warning to remind staff to strengthen management.

[0013] Furthermore, the hierarchy graph construction module performs the following operations:

[0014] Let G = (G city G outlet This represents a hierarchical diagram of "mail city transit centers - outlets", where G city ={V c E c} is a map of mail city transit centers, and Goutlet is a map of its network of outlets;

[0015] The mail city transit centers that the mail passes through during transportation are treated as nodes in the mail city transit center graph, denoted as set V. c ={V i c |i=1,2,...,N c}, V i c Represents the central node, N c E represents the number of nodes in the mail city transit center map, and also the number of outlets in the network map. c This is the set of edges connecting the nodes in the mail city transfer center graph;

[0016] Each mail city transit center has its own network map and serves as the central node of its respective network map. For each central node V... i c There is a network map. Correspondingly, among them and V i o and Let these represent the set of nodes and the set of edges in the dot graph, respectively.

[0017] Each central node V i c It is associated with a label yi = {0, 1, 2, 3, 4}. When the label value is 0, it indicates a low-risk state; when the label value is 1, it indicates a slightly low-risk state; when the label value is 2, it indicates a medium-risk state; when the label value is 3, it indicates a slightly high-risk state; and when the label value is 4, it indicates a high-risk state.

[0018] Edge E in the mail city transit center diagram c and edges in the dot graph The weights are determined by the geographical similarity g between nodes. s and frequency of email correspondence f s The composition, expressed by the formula, is as follows:

[0019]

[0020] In the formula: xa and x b It is node V a and V b latitude, y a and y b It is node V a and V b longitude, d a,b It is node V a and V b The Euclidean distance between them It is node V a and V b Geographical similarity between them Node V a and V b Frequency of email exchanges between them It is node V a and V b The edge weights between them are α and β, which are weighting coefficients.

[0021] Furthermore, the email data import module performs the following operations:

[0022] Import email order data, including: email barcode, pickup and delivery time, pickup person, organization code, customer code, sender, sender address, sender phone number, recipient, recipient address, recipient phone number, and product description, and use natural language processing technology to convert the text description into vectors;

[0023] Import email image recognition data, and use X-ray security inspection intelligent detection algorithm and component matching algorithm to jointly determine the probability that the email contains prohibited items;

[0024] Import historical email data from the database, including: the number of historically detected dangerous emails, historical blacklisted phone numbers, and historical blacklisted customer codes.

[0025] Furthermore, the email feature extraction module performs the following operations:

[0026] The email data obtained after preprocessing in the email data import module is integrated to obtain a three-dimensional matrix. As input, where Let N represent the set of real numbers, T represent the total number of mail city transfer centers and outlets, M represent the time step, and M represent the dimension of mail data.

[0027] An encoder-decoder model based on an LSTM network is constructed to perform encoding and decoding operations on email data. The model includes an encoder, a decoder, and fully connected layers. The encoder consists of an LSTM network used to process a three-dimensional matrix x. t Encoding operations, also known as recursive processing, are represented by the encoder's operations as follows:

[0028] h t ,c t =LSTM0(x t ,h t-1 ,c t-1 )

[0029] Where: h t h is the t-th element of the encoder's state output vector, which is also the encoder's output. t-1 c is the (t-1)th element of the state output vector in the encoder. t and c t-1 These are the t-th and t-1-th elements of the cell memory state vector in the encoder, respectively, and LSTM0(·) represents the encoder;

[0030] The decoder consists of an LSTM network used to perform decoding operations on the encoder's output. The decoder's operation is represented as follows:

[0031]

[0032] In the formula: It is the t-th element of the state output vector in the decoder, which is also the output of the decoder. It is the (t-1)th element of the state output vector in the decoder. and These are the t-th and t-1-th elements of the cell memory state vector in the decoder, respectively, and LSTM1(·) represents the decoder;

[0033] The decoder output is passed through a fully connected layer. The operations of the fully connected layer are represented as follows:

[0034]

[0035] In the formula: It is the compressed email data, which is also the node feature. d is the dimension of the compressed email data, and FC(·) is the fully connected layer operation.

[0036] Furthermore, the loss function of the encoder-decoder model is the mean squared error loss.

[0037] Furthermore, the node feature update module performs the following operations:

[0038] The j-th row of the compressed email data obtained by the email feature extraction module represents the initial feature of the j-th node in the hierarchical graph. The message passing mechanism of the hierarchical graph neural network is used to update the node features between and within layers, so that each node contains richer global features.

[0039] For node V in the mail city transit center diagram aIts messages come from neighboring nodes and itself, as shown in the following formula:

[0040]

[0041] In the formula: x a For node V a Features, x n For node V a The characteristics of the neighboring nodes, For node V a The edge weights with neighboring nodes, M a To be passed to node V a The collection of all messages;

[0042] Will be passed to node V a The set M of all messages a The encoding is performed using the following formula:

[0043]

[0044] Where: m a The vector after message encoding. For encoding operations;

[0045] The message-encoded vector m a For node V a The features are updated using the following formula:

[0046]

[0047] In the formula: For the updated node V a The characteristics of Att1(·) are that Att1(·) is an update function based on the attention mechanism;

[0048] Update with node V a The characteristics of nodes in a dot matrix with a central node are defined by the following formula:

[0049]

[0050] In the formula: Based on node V a For the updated node characteristics of node k in the point graph with the central node, m a,k Based on node V a x is the message aggregation vector of node k in the dot matrix of the central node. a,k Based on node V a The original feature of node k in the dot matrix graph with the central node is... For the updated node V a The characteristics of Att2 are that Att2(·) is an update function based on the attention mechanism.

[0051] Furthermore, the node risk warning module performs the following operations:

[0052] Using the node features obtained from the node feature update module as input, a neural network consisting of fully connected layers and a sigmoid activation function is used to obtain the risk category probability prediction value for each node. For node V... a The formula for calculating the probability prediction value of its risk category is as follows:

[0053]

[0054] In the formula: For node V a The risk category probability prediction value, sigmoid(·) is the activation function, and FC(·) is the fully connected layer operation;

[0055] The loss function for the above neural network is the cross-entropy loss, as shown in the following formula:

[0056]

[0057] In the formula: l is the loss value, Let C be the total number of nodes, C be the total number of risk categories, and y be the total number of nodes. qc Let be the label value of the c-th category of the q-th node. This represents the predicted probability value of the risk category for the c-th category at the q-th node.

[0058] The node with the highest predicted risk category value is selected as its risk category. When a node is in a high or low risk category, the system will activate a safety warning to remind staff to strengthen control.

[0059] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0060] 1. For the first time, a hierarchical diagram of "mail city transfer center - outlet" was constructed, which effectively reveals the dependency relationship and hierarchical structure between mail city transfer centers and outlets in the mail transportation process. Through this hierarchical representation, not only can the transmission path of mail from one node to another be clearly shown, but also the interaction and influence between each node can be better understood, thereby improving the overall control of the entire mail transportation link.

[0061] 2. For the first time, hierarchical graph neural network technology is introduced to predict node risks in the email link from a global perspective. By capturing the mutual influence between nodes in the email link, the system can more accurately predict potential risks and identify potentially problematic nodes, thereby significantly improving the accuracy of node risk prediction.

[0062] 3. By combining natural language processing and image recognition technologies, and making full use of mail order data and X-ray security inspection image information, the accuracy of identifying dangerous mail at a single node can be improved.

[0063] 4. The system of this invention can perform real-time node risk warning. When a potential risk is detected, it can immediately issue an alarm to security personnel, prompting them to pay attention to specific high-risk mail or nodes, assisting security personnel in rationally allocating their attention, enhancing risk monitoring and control capabilities throughout the mail transportation process, and effectively reducing mail security risks. Attached Figure Description

[0064] Figure 1 This is a framework diagram of the system of the present invention.

[0065] Figure 2 The diagram shows the hierarchical structure of "Mail City Transfer Center - Outlets"; in the diagram, gray nodes represent mail city transfer centers, and white nodes represent outlets.

[0066] Figure 3 This is a structural diagram of the email data import module.

[0067] Figure 4 The structure diagram is for the email feature extraction module. Detailed Implementation

[0068] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0069] like Figure 1 As shown, this embodiment discloses an email risk warning system based on hierarchical graph neural networks and LSTM, developed using the Python language, which includes:

[0070] The hierarchical diagram construction module is used to construct a hierarchical diagram of "mail city transfer centers - outlets", such as... Figure 2 As shown, the mail city transfer centers and outlets that mail passes through during transportation are abstracted into nodes, and adjacent nodes are used to construct edges to obtain a graph structure. A hierarchical graph structure is obtained through layered processing, thereby modeling the complex spatiotemporal dependencies between nodes at different granularities.

[0071] The email data import module is used to import three types of data: email order data from email city transfer centers and outlets, email image recognition data, and historical email data from the database. It also performs preprocessing operations on these three types of data, including deleting outliers and redundant data, to obtain preprocessed email data.

[0072] The email feature extraction module is used to extract features from the email data preprocessed by the email data import module. It uses an LSTM (Long Short-Term Memory) network to encode and decode the email data, automatically learns the key features in the email data, realizes dimensionality reduction and feature extraction of email data, and obtains node features.

[0073] The node feature update module is used to update the node features obtained by the email feature extraction module. It uses a hierarchical graph neural network and attention mechanism to perform message aggregation and representation update of nodes between and within layers, and obtains the final feature representation of nodes in the hierarchical graph.

[0074] The node risk warning module is used to predict the probability of risk categories for nodes in the hierarchical graph. The input is the final feature representation of the node obtained by the node feature update module. The risk classification of the node is performed by a neural network consisting of fully connected layers and a sigmoid activation function. The risk categories are set to five categories: low, slightly low, medium, slightly high, and high. When a node is in the slightly high or high category, the system will activate a safety warning to remind staff to strengthen management.

[0075] Specifically, the hierarchy graph construction module performs the following operations:

[0076] Let G = (G city G outlet This represents a hierarchical diagram of "mail city transit centers - outlets", where G city ={V c E c} is a map of mail city transit centers, and Goutlet is a map of its network of outlets;

[0077] The mail city transit centers that the mail passes through during transportation are treated as nodes in the mail city transit center graph, denoted as set V. c ={V i c |i=1,2,...,N c}, V i c Represents the central node, N c E represents the number of nodes in the mail city transit center map, and also the number of outlets in the network map. c This is the set of edges connecting the nodes in the mail city transfer center graph;

[0078] Each mail city transit center has its own network map and serves as the central node of its respective network map. For each central node V... i c There is a network map. Correspondingly, among them and V i oand Let these represent the set of nodes and the set of edges in the dot graph, respectively.

[0079] Each central node V i c It is associated with a label yi = {0, 1, 2, 3, 4}. When the label value is 0, it indicates a low-risk state; when the label value is 1, it indicates a slightly low-risk state; when the label value is 2, it indicates a medium-risk state; when the label value is 3, it indicates a slightly high-risk state; and when the label value is 4, it indicates a high-risk state.

[0080] Edge E in the mail city transit center diagram c and edges in the dot graph The weights are determined by the geographical similarity g between nodes. s and frequency of email correspondence f s The composition, expressed by the formula, is as follows:

[0081]

[0082] In the formula: x a and x b It is node V a and V b latitude, y a and y b It is node V a and V b longitude, d a,b It is node V a and V b The Euclidean distance between them It is node V a and V b Geographical similarity between them Node V a and V b Frequency of email exchanges between them It is node V a and V b The edge weights between them are α and β, which are weighting coefficients.

[0083] Specifically, such as Figure 3 As shown, the email data import module performs the following operations:

[0084] Import email order data, including: email barcode, pickup and delivery time, pickup person, organization code, customer code, sender, sender address, sender phone number, recipient, recipient address, recipient phone number, and product description, and use natural language processing technology to convert the text description into vectors;

[0085] Import email image recognition data, and use X-ray security inspection intelligent detection algorithm and component matching algorithm to jointly determine the probability that the email contains prohibited items;

[0086] Import historical email data from the database, including: the number of historically detected dangerous emails, historical blacklisted phone numbers, and historical blacklisted customer codes.

[0087] Specifically, such as Figure 4 As shown, the email feature extraction module performs the following operations:

[0088] The email data obtained after preprocessing in the email data import module is integrated to obtain a three-dimensional matrix. As input, where Let N represent the set of real numbers, T represent the total number of mail city transfer centers and outlets, M represent the time step, and M represent the dimension of mail data.

[0089] An encoder-decoder model based on an LSTM network, using mean squared error loss as its loss function, is constructed to perform encoding and decoding operations on email data. The model comprises an encoder, a decoder, and fully connected layers. The encoder consists of an LSTM network used to process the three-dimensional matrix x. t Encoding operations, also known as recursive processing, are represented by the encoder's operations as follows:

[0090] h t ,c t =LSTM0(x t ,h t-1 ,c t-1 )

[0091] Where: h t h is the t-th element of the encoder's state output vector, which is also the encoder's output. t-1 c is the (t-1)th element of the state output vector in the encoder. t and c t-1 These are the t-th and t-1-th elements of the cell memory state vector in the encoder, respectively, and LSTM0(·) represents the encoder;

[0092] The decoder consists of an LSTM network used to perform decoding operations on the encoder's output. The decoder's operation is represented as follows:

[0093]

[0094] In the formula: It is the t-th element of the state output vector in the decoder, which is also the output of the decoder. It is the (t-1)th element of the state output vector in the decoder. and These are the t-th and t-1-th elements of the cell memory state vector in the decoder, respectively, and LSTM1(·) represents the decoder;

[0095] The decoder output is passed through a fully connected layer. The operations of the fully connected layer are represented as follows:

[0096]

[0097] In the formula: It is the compressed email data, which is also the node feature. d is the dimension of the compressed email data, and FC(·) is the fully connected layer operation.

[0098] Specifically, the node feature update module performs the following operations:

[0099] The j-th row of the compressed email data obtained by the email feature extraction module represents the initial feature of the j-th node in the hierarchical graph. The message passing mechanism of the hierarchical graph neural network is used to update the node features between and within layers, so that each node contains richer global features.

[0100] Using node V in the mail city transit center diagram a For example, node V a The message comes from neighboring nodes and itself, as shown in the following formula:

[0101]

[0102] In the formula: x a For node V a Features, x n For node V a The characteristics of the neighboring nodes, For node V a The edge weights with neighboring nodes, M a To be passed to node V a The collection of all messages;

[0103] Will be passed to node V a The set M of all messages a The encoding is performed using the following formula:

[0104]

[0105] Where: m a The vector after message encoding. For encoding operations;

[0106] The message-encoded vector m a For node V a The features are updated using the following formula:

[0107]

[0108] In the formula: For the updated node V a The characteristics of Att1(·) are that Att1(·) is an update function based on the attention mechanism;

[0109] Update with node V a The characteristics of nodes in a dot matrix with a central node are defined by the following formula:

[0110]

[0111] In the formula: Based on node V a For the updated node characteristics of node k in the point graph with the central node, m a,k Based on node V a x is the message aggregation vector of node k in the dot matrix of the central node. a,k Based on node V a The original feature of node k in the dot matrix graph with the central node is... For the updated node V a The characteristics of Att2 are that Att2(·) is an update function based on the attention mechanism.

[0112] Specifically, the node risk warning module performs the following operations:

[0113] Using the node features obtained from the node feature update module as input, a neural network consisting of fully connected layers and a sigmoid activation function is used to obtain the risk category probability prediction value for each node, with node V as the input. a For example, node V a The formula for calculating the probability prediction value of risk categories is as follows:

[0114]

[0115] In the formula: For node V a The risk category probability prediction value, sigmoid(·) is the activation function, and FC(·) is the fully connected layer operation;

[0116] The loss function for the above neural network is the cross-entropy loss, as shown in the following formula:

[0117]

[0118] In the formula: l is the loss value, Let C be the total number of nodes, C be the total number of risk categories, and y be the total number of nodes. qc Let be the label value of the c-th category of the q-th node. This represents the predicted probability value of the risk category for the c-th category at the q-th node.

[0119] The node with the highest predicted risk category value is selected as its risk category. When a node is in a high or low risk category, the system will activate a safety warning to remind staff to strengthen control.

[0120] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. An email risk warning system based on hierarchical graph neural networks and LSTM, characterized in that, include: The hierarchical graph construction module is used to construct a hierarchical graph of "mail city transfer center - outlet". It abstracts the mail city transfer centers and outlets that mail passes through during transportation into nodes, constructs edges between adjacent nodes to obtain a graph structure, and obtains a hierarchical graph structure through layering, thereby modeling the complex spatiotemporal dependencies between nodes at different granularities. The email data import module is used to import three types of data: email order data from email city transfer centers and outlets, email image recognition data, and historical email data from the database. It also performs preprocessing operations on these three types of data, including deleting outliers and redundant data, to obtain preprocessed email data. The email feature extraction module is used to extract features from the email data preprocessed by the email data import module. It uses an LSTM network to perform encoding and decoding operations on the email data, automatically learns the key features in the email data, realizes dimensionality reduction and feature extraction of email data, and obtains node features. The node feature update module is used to update the node features obtained by the email feature extraction module. It uses a hierarchical graph neural network and attention mechanism to perform message aggregation and representation update of nodes between and within layers, and obtains the final feature representation of nodes in the hierarchical graph. The node risk warning module is used to predict the risk category probability of nodes in the hierarchical graph. The input is the final feature representation of the node obtained by the node feature update module. The risk classification of the node is performed by a neural network composed of fully connected layers and sigmoid activation function. The risk categories are set to five categories: low, slightly low, medium, slightly high, and high. When a node is in the slightly high or high category, the system will activate a safety warning prompt to remind staff to strengthen control. The hierarchy graph construction module performs the following operations: set up This represents a hierarchical diagram of "mail city transit centers - outlets", where Map of mail city transit centers For the dot map; The mail city transit centers that the mail passes through during transportation are treated as nodes in the mail city transit center graph, denoted as set. , Represents the central node, This represents the number of nodes in the mail city transit center map, and also the number of service points in the network map. This is the set of edges connecting the nodes in the mail city transfer center graph; Each mail city transit center has its own network map and serves as the central node in its respective network map. For each central node... There is a network map. Correspondingly, among them ,and , and Let these represent the set of nodes and the set of edges in the dot graph, respectively. Each central node With a label The associated values ​​are as follows: a label value of 0 indicates a low-risk state, a label value of 1 indicates a slightly low-risk state, a label value of 2 indicates a medium-risk state, a label value of 3 indicates a slightly high-risk state, and a label value of 4 indicates a high-risk state. Edges in the mail city transit center diagram and edges in the dot graph The weights are determined by the geographical similarity between nodes. Frequency of email correspondence The composition, expressed by the formula, is as follows: ； ； ； In the formula: and It is a node and latitude, and It is a node and longitude, It is a node and The Euclidean distance between them It is a node and Geographical similarity between them node and Frequency of email exchanges between them It is a node and Edge weights between them and These are weighting coefficients.

2. The email risk warning system based on hierarchical graph neural network and LSTM according to claim 1, characterized in that, The email data import module performs the following operations: Import email order data, including: email barcode, pickup and delivery time, pickup person, organization code, customer code, sender, sender address, sender phone number, recipient, recipient address, recipient phone number, and product description, and use natural language processing technology to convert the text description into vectors; Import email image recognition data, and use X-ray security inspection intelligent detection algorithm and component matching algorithm to jointly determine the probability that the email contains prohibited items; Import historical email data from the database, including: the number of historically detected dangerous emails, historical blacklisted phone numbers, and historical blacklisted customer codes.

3. The email risk warning system based on hierarchical graph neural network and LSTM according to claim 2, characterized in that, The email feature extraction module performs the following operations: The email data obtained after preprocessing in the email data import module is integrated to obtain a three-dimensional matrix. As input, where Represents the set of real numbers. This indicates the total number of mail city transfer centers and outlets. Indicates the time step. Indicates the dimensions of email data; An encoder-decoder model based on an LSTM network is constructed to perform encoder-decoder operations on email data. The model includes an encoder, a decoder, and fully connected layers. The encoder consists of an LSTM network used to process a three-dimensional matrix. Encoding operations, also known as recursive processing, are represented by the encoder's operations as follows: ； In the formula: It is the first state output vector in the encoder. Each element is also the output of the encoder. It is the first state output vector in the encoder. One element, and These are the first and second digits of the cell memory state vector in the encoder. and One element, Represents an encoder; The decoder consists of an LSTM network used to perform decoding operations on the encoder's output. The decoder's operation is represented as follows: ； In the formula: It is the th state output vector in the decoder Each element is also the output of the decoder. It is the th state output vector in the decoder One element, and These are the first and second digits of the cell memory state vector in the decoder. and One element, Represents the decoder; The decoder output is passed through a fully connected layer. The operations of the fully connected layer are represented as follows: ； In the formula: It is compressed email data, and also a node characteristic. For the dimensions of compressed email data, This is for fully connected layer operations.

4. The email risk warning system based on hierarchical graph neural network and LSTM according to claim 3, characterized in that, The loss function of the encoder-decoder model is the mean squared error loss.

5. The email risk warning system based on hierarchical graph neural network and LSTM according to claim 4, characterized in that, The node feature update module performs the following operations: Define the first part of the compressed email data obtained by the email feature extraction module. Rows represent the first row in the hierarchy diagram. The initial features of each node are updated between and within layers using the message passing mechanism of the hierarchical graph neural network, so that each node contains richer global features. For the nodes in the mail city transit center diagram Its messages come from neighboring nodes and itself, as shown in the following formula: ； In the formula: For nodes Features For nodes The characteristics of the neighboring nodes, For nodes Edge weights with neighboring nodes, To be passed to the node The collection of all messages; Will be passed to the node The collection of all messages The encoding is performed using the following formula: ； In the formula: The vector after message encoding. For encoding operations; The vector after message encoding For nodes The features are updated using the following formula: ； In the formula: For the updated node Features This is an update function based on an attention mechanism; Update by node The characteristics of nodes in a dot matrix with a central node are defined by the following formula: ； In the formula: Based on nodes Nodes in a dot matrix with the central node Updated node features Based on nodes Nodes in a dot matrix with the central node The message aggregation vector, Based on nodes Nodes in a dot matrix with the central node The original characteristics, For the updated node Features This is an update function based on the attention mechanism.

6. The email risk warning system based on hierarchical graph neural network and LSTM according to claim 5, characterized in that, The node risk warning module performs the following operations: Using the node features obtained from the node feature update module as input, a neural network consisting of fully connected layers and a sigmoid activation function is used to obtain the risk category probability prediction value for each node. The formula for calculating the probability prediction value of its risk category is as follows: ； In the formula: For nodes Risk category probability prediction value, For activation function, This is for fully connected layer operations; The loss function for the above neural network is the cross-entropy loss, as shown in the following formula: ； In the formula: The loss value. The total number of nodes. The total number of risk categories. For the first The node The label values ​​for each category, For the first The node Predicted probability values ​​for each risk category; The node with the highest predicted risk category value is selected as its risk category. When a node is in a high or low risk category, the system will activate a safety warning to remind staff to strengthen control.

Images