Short message information security detection method and system based on content platform data mining

Abstract

The invention belongs to the field of software security, and particularly relates to a short message information security detection method and system based on content platform data mining, and the method comprises the steps: collecting user published data from a content platform, and carrying out the preliminary filtering of the data through a classifier; identifying the preliminarily filtered data by adopting a target detection algorithm to obtain short message data; extracting text features of the short message data, and adopting a BART model to realize short message abstract extraction; generating an embedded vector for the extracted summary information by adopting a sentence embedding model, and comparing the embedded vector with an embedded vector in an existing fraud short message knowledge base so as to find whether the fraud short message has a novel short message fraud behavior or not; according to the method, a plurality of content filtering modules are designed to filter noise data by comprehensively utilizing a text classification algorithm, a target detection algorithm and a picture content extraction algorithm, so that fraud short messages can be quickly and accurately recognized from massive data, and the efficiency of timeliness of novel fraud behavior discovery is improved.

Description

Technical Field

[0001] The present invention belongs to the field of software security in information security, and specifically relates to a text message information security detection method and system based on content platform data mining. Background Art

[0002] Fraudulent SMS is a type of spam SMS. Domestic and foreign scholars have done a lot of research in the field of spam SMS identification and proposed some feasible spam SMS detection methods and avoidance strategies. Existing methods are mainly divided into: spam SMS detection methods based on SMS content features and spam SMS detection methods based on SMS behavior features. Spam SMS detection methods based on SMS content features mainly use SMS content features such as text features, statistical features, and semantic features to build classifiers through machine learning methods such as SVM and Bayesian networks, thereby realizing the detection of spam SMS such as fraudulent SMS and illegal advertising SMS. With the rapid development of deep learning technology, some researchers have improved the performance of spam SMS detection by introducing models such as RNN and FastText. At the same time, some studies have released spam SMS labeling datasets to promote future spam SMS detection research. Spam SMS detection methods based on SMS behavior features mainly extract features related to spam SMS from SMS sending behavior to detect spam SMS. Some studies focus on the infrastructure of SMS communication, such as fake base stations and SMS gateways, and detect spam SMS through network signal features such as received cellular signals and traffic behavior characteristics of senders. Related methods can also improve the situational awareness of spam SMS. One of the latest spam SMS datasets, FBSSMS Spam Dataset, manually labels spam SMS collected by real fake base stations in China into 14 categories according to the service types of spam SMS. The limitations of the collection strategy make the dataset unable to be expanded. Some studies have also clustered sender behaviors, extracted behavioral features such as business categories, user trap strategies, and avoidance techniques, and further combined user behavior analysis and data modeling to establish spam SMS detection models, thereby improving the accuracy and efficiency of spam SMS detection.

[0003] Although researchers at home and abroad have proposed many SMS fraud detection methods and implemented prototype systems, cases of mobile users being defrauded by SMS are still emerging. Existing detection methods face the following challenges: (1) SMS fraud attack methods are constantly upgrading, and the detection accuracy of existing methods is insufficient. In the face of spam SMS detection methods based on behavioral characteristics, attackers use anonymous proxy servers or SMS bombing, combined with adaptive models, generative adversarial networks and other technologies to create more confusing and adaptive spam SMS attacks, which can confuse the detection system and slow down the response speed. In the face of spam SMS detection methods based on content characteristics, attackers shorten the SMS length and modify sensitive SMS content by using idioms and abbreviations to evade detection. (2) Fraudulent SMS content changes quickly and has many variants. Existing detection methods are unable to cope with new SMS fraud behaviors. With the improvement of mobile Internet application service capabilities, attackers construct fraudulent SMS by taking advantage of new service types and hot social events. The content features extracted by existing research methods are limited by the integrity and timeliness of labeled data sets, resulting in the inability to effectively discover and detect new SMS fraud behaviors. Summary of the invention

[0004] In order to solve the problems existing in the above prior art, the present invention proposes a SMS information security detection method based on content platform data mining, which includes obtaining historical SMS information data in the content platform and building a SMS information security detection knowledge base; obtaining SMS data to be detected; inputting the SMS data to be detected into the trained SMS information security detection model to obtain the detection result;

[0005] Training the SMS fraud detection model includes:

[0006] Collect data posted by users from the content platform, use a classifier to perform preliminary filtering on the data posted by users; use a target detection algorithm to identify the preliminary filtered data to obtain SMS data; extract text features of the SMS data, and use the BART model to extract SMS summary information of the text features; input the SMS summary information into the sentence embedding model Sentence-BERT to obtain an embedding vector; compare the embedding vector with the embedding vector in the SMS information security detection knowledge base to determine whether the SMS information to be detected has security risks; calculate the model's loss function based on the detection results, adjust the model's parameters, and complete the model training when the loss function converges.

[0007] A text message information security detection system based on content platform data mining, the system includes: a data collection module, a text message information filtering module and a text message information security detection module;

[0008] The data collection module is used to collect data information published by users;

[0009] The SMS information filtering module is used to filter the collected user data information to obtain SMS data;

[0010] The SMS information security detection module is used to perform information security detection on the filtered SMS data to obtain a detection result.

[0011] Beneficial effects of the present invention:

[0012] The present invention takes advantage of the fact that users usually share the SMS fraud they have suffered on the content publishing platform, and designs and invents a method and device for discovering SMS fraud through content platform data mining. The present invention can help regulatory authorities identify effective information from massive data and discover new fraudulent behaviors, greatly reducing manpower and material costs, while being able to update regulatory measures in a timely manner to better protect the safety of mobile users. The present invention designs multiple content filtering modules to filter noise data by comprehensively utilizing text classification algorithms, target detection algorithms, and image content extraction algorithms, so that fraudulent SMS can be quickly and accurately identified from massive data, greatly improving the efficiency of SMS fraud identification and meeting application requirements in the context of massive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is the overall system framework structure diagram of the present invention;

[0014] Figure 2 It is the overall flow chart of the present invention;

[0015] Figure 3 This is a flow chart of the classifier of the present invention performing preliminary filtering on user data. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] A SMS information security detection method based on content platform data mining, such as Figure 2 As shown, the method includes: obtaining historical SMS information data in the content platform and building a SMS information security detection knowledge base; obtaining SMS data to be detected; inputting the SMS data to be detected into the trained SMS information security detection model to obtain the detection result.

[0018] Training the SMS fraud detection model includes: collecting data posted by users from the content platform, using a classifier to perform preliminary filtering on the data posted by users; using a target detection algorithm to identify the preliminary filtered data to obtain SMS data; extracting text features of the SMS data, and using the BART model to extract SMS summary information of the text features; inputting the SMS summary information into the sentence embedding model Sentence-BERT to obtain an embedding vector; comparing the embedding vector with the embedding vector in the SMS information security detection knowledge base to determine whether there are security risks in the SMS information to be detected; calculating the loss function of the model based on the detection results, adjusting the parameters of the model, and completing the model training when the loss function converges.

[0019] In this embodiment, data collection includes: selecting appropriate collection strategies for mainstream content platforms such as Xiaohongshu, Zhihu, WeChat public accounts, and Weibo, and using web crawler technology to periodically and automatically collect content related to SMS fraud posted by users. Among them, for social media platforms with content sharing, such as Weibo, Xiaohongshu, WeChat public accounts, etc., by simulating search requests for keywords such as "fraudulent SMS" and "telecommunication fraud", the search result page is obtained and parsed, and incremental search results are automatically crawled. For question-and-answer community-type and topic discussion-type content platforms, such as Zhihu and Tieba, by collecting and organizing hot topics or posts related to the discussion of fraudulent SMS, the content posted and replied therein is periodically crawled incrementally. The crawled data is stored in the form of documents.

[0020] Since the collected data contains a lot of noise data, for example, popular science articles on SMS fraud usually only contain traditional common fraud introductions and warning information. Therefore, the present invention uses the fact that noise data is usually expressed in the third person, extracts text features to build a classifier, and achieves preliminary filtering of noise data.

[0021] The classifier is used to perform preliminary filtering on the collected user-posted data, including: adding labels to the collected user-posted text content through manual labeling to build a training data set, and the labels are divided into "noise data" and "non-noise data"; segmenting the Chinese short text data and removing non-Chinese characters and special symbols; extracting the key features of the document through TF-IDF, calculating the TF-IDF value of each word, and obtaining a feature vector; training the SVM classifier based on the classification label and feature vector, and mapping the input vector to a high-dimensional space through a kernel function to obtain the similarity between texts; evaluating the model performance of different hyperparameter combinations through a ten-fold cross-evaluation, selecting the best performing hyperparameter combination based on the average performance index of cross-validation, and finally realizing the construction of the classifier; and filtering the user data with the final classifier.

[0022] Specific steps are as follows Figure 3 As shown, including:

[0023] Step 1. Data preparation: Collect user-posted text content and add labels to build a training data set through manual labeling. The labels are divided into "noise data" and "non-noise data", which are marked as 0 and 1 in the database respectively.

[0024] Step 2. Data preprocessing: Use the Jieba tool to segment Chinese short text data and remove noise such as non-Chinese characters and special symbols to reduce the impact of irrelevant information on model performance.

[0025] Step 3. Feature selection: Extract the key features of the document through TF-IDF, calculate the TF-IDF value of each word, and obtain a feature vector for training the classification model. The specific process is as follows: Calculate the word frequency of the sequence after word segmentation and normalize it, transform the word segmentation sequence into a sparse feature vector, and the feature vector represents the importance of a specific word to the document. At this time, calculate the inverse file frequency to correct the word frequency feature vector and obtain the TF-IDF metric value corresponding to each word. The feature vector at this time represents the general importance of the word in the entire document collection.

[0026] Step 4. Model training: Use the extracted features and corresponding labels to train the SVM classifier, and map the input vector to a high-dimensional space through the kernel function to capture the similarity between texts.

[0027] Step 5. Hyperparameter tuning: Evaluate the model performance of different hyperparameter combinations through ten-fold cross-validation. Select the best performing hyperparameter combination based on the average performance index of cross-validation to finally build the classifier.

[0028] Step 6. Model application: Use the classification model to predict new documents and perform preliminary filtering of text noise data.

[0029] In this embodiment, for the filtered data, in order to accurately obtain information related to fraudulent behavior, this patent further uses the target detection algorithm to construct a text message screenshot image detector, and by identifying whether the image in the document contains a text message unit dialog box, the document containing fraudulent text message screenshots is screened out. Among them, the steps for constructing the image detector are as follows: annotate the image by the rotating rectangular box annotation tool roLabelImg to construct a training data set; use the characteristics that the text message dialog box is usually a regular shape, and the color is obviously different from the background color, to perform data enhancement, normalization and other preprocessing on the image; build the YOLOv8 network structure and define its loss function; train the YOLOv8 model, through forward and backward propagation, iterative optimization until the model converges, and finally save the model weights obtained by training to realize the construction of the image detector.

[0030] In this embodiment, for the identified fraudulent SMS images, in order to accurately extract the SMS text content, the text paragraphs and their text box coordinate information in the SMS screenshot are first extracted through the OCR engine Tesseract, and the text box coordinates are compared with the SMS unit dialog coordinates obtained in S3. If most of the text paragraphs fall within the SMS unit dialog, then the text paragraph is likely to be SMS text. The intersection over union (IoU) is used as a metric:

[0031]

[0032] If the IoU value is greater than the set threshold, it is determined to be a text message and the text content is extracted. The default threshold in the device is 0.5, and the user can set it according to the actual situation.

[0033] SMS fraud behavior extraction: After preprocessing the fraud SMS text content extracted by S4 and the text content posted by users in the documents collected by S1, the BART model is used to extract SMS summary information with text features, including: converting the input data through Tokenizer; encoding the converted SMS text, and using the pre-trained BART model to process the encoded text to generate a concise summary; using the data in the SMS information security detection knowledge base to fine-tune the BART model to adapt to the SMS data.

[0034] Information security testing of SMS data includes: using the pre-trained sentence embedding model Sentence-BERT to generate an embedding vector with semantic meaning. The closer the semantics, the closer the distance between the embedding vectors. Calculate the embedding vectors of the summary extracted from S5 and the summary information of the fraudulent behavior in the knowledge base, use cosine similarity to calculate the similarity between the generated summary and the knowledge base summary, and find the knowledge base summary with the highest similarity. If the cosine similarity is greater than the set threshold, the fraudulent behavior is determined to be similar. The default threshold in the device is 0.5, and the user can set it according to actual conditions. When a fraudulent behavior summary that is not similar to the knowledge base appears, it is first manually reviewed and confirmed. If it is correct, it is defined as a new type of SMS fraud and updated according to the fraudulent behavior knowledge base data format requirements.

[0035] For information security test results, output related document information, SMS screenshot text extraction information, fraud behavior description information, etc. The results can be exported in DOC and PDF formats.

[0036] Comparing the embedding vector with the embedding vector in the SMS information security detection knowledge base includes: comparing the embedding vectors of 5 keywords with the keywords in the SMS security detection knowledge base; specifically, calculating the embedding vector of the extracted summary and the summary information of the fraudulent behavior in the knowledge base, using the cosine similarity calculation to generate the similarity between the summary and the knowledge base summary, and finding the knowledge base summary with the highest similarity; if the cosine similarity is greater than the set threshold, the fraudulent behavior is determined to be similar; when a dissimilar fraudulent behavior summary in the knowledge base appears, it is manually reviewed and confirmed, and if it is correct, it is defined as a new type of SMS fraud behavior and updated according to the fraudulent behavior knowledge base data format requirements.

[0037] The formula for calculating the similarity between the generated summary and the knowledge base summary is:

[0038]

[0039] Among them, v1 is the keyword embedding vector of the abstract, and v2 is the keyword embedding vector of the knowledge base.

[0040] The similarity formula is optimized, that is, the summary text is segmented into words, each word corresponds to an embedding vector, and the weight is optimized by word frequency. wi is the weight of the i-th word. The optimized expression is:

[0041]

[0042] Among them, v 1,i and v 2,i is the embedding vector of the i-th keyword in the two summaries, w i is the weight.

[0043] A SMS information security detection system based on content platform data mining, such as Figure 1 As shown, the system includes: a data acquisition module, a text message filtering module and a text message security detection module;

[0044] The data collection module is used to collect data information published by users;

[0045] The SMS information filtering module is used to filter the collected data information posted by the user to obtain SMS data;

[0046] The SMS information security detection module is used to perform information security detection on the filtered SMS data to obtain a detection result.

[0047] In this embodiment, the specific implementation of the system is the same as the specific implementation of the method.

[0048] The above embodiments further illustrate the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above embodiments are only preferred implementation modes of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made to the present invention within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting SMS information security based on content platform data mining, characterized in that: include: Obtain historical SMS information data from the content platform and build a SMS information security detection knowledge base; Get the SMS data to be detected; Input the SMS data to be tested into the trained SMS information security detection model to obtain the detection result; Training the SMS information security detection model includes: collecting data posted by users from the content platform, and using a classifier to perform preliminary filtering on the data posted by users; The target detection algorithm is used to identify the preliminary filtered data to obtain SMS data; the text features of the SMS data are extracted, and the SMS summary information of the text features is extracted using the BART model; the SMS summary information is input into the sentence embedding model Sentence-BERT to obtain an embedding vector; the embedding vector is compared with the embedding vector in the SMS information security detection knowledge base to determine whether the SMS information to be detected has security risks; the loss function of the model is calculated based on the detection results, and the parameters of the model are adjusted. When the loss function converges, the model training is completed.

2. According to claim 1, a method for detecting the security of short message information based on content platform data mining is characterized in that: Collecting user data from the content platform includes: using web crawler technology to periodically and automatically collect content related to text messages posted by users.

3. The SMS information security detection method based on content platform data mining according to claim 1 is characterized in that: The classifier is used to perform preliminary filtering on the collected user-posted data, including: adding labels to the collected user-posted text content by manual marking to obtain a training data set, where the labels are divided into "noise data" and "non-noise data"; segmenting the Chinese short text data and removing non-Chinese characters and special symbols; calculating the TF-IDF value of each word in the text without non-Chinese characters and special symbols to obtain a feature vector; training the SVM classifier based on the classification label and the feature vector, and mapping the input vector to a high-dimensional space through a kernel function to obtain the similarity between texts; using a ten-fold crossover to evaluate the model performance of different hyperparameter combinations, and selecting the optimal hyperparameter combination based on the average performance index of cross-validation to obtain a classifier; and using the classifier to filter the user-posted data.

4. The SMS information security detection method based on content platform data mining according to claim 1 is characterized in that: The target detection algorithm is used to identify the preliminary filtered data, including: annotating images through the rotating rectangular box annotation tool roLabelImg to construct a training data set; performing image enhancement and normalization on the images in the training data set; inputting the normalized image data into the YOLOv8 network model for training, iteratively optimizing through forward and backward propagation until the model converges, and saving the model weights obtained through training; using the trained YOLOv8 network model to identify the filtered data to obtain SMS data.

5. The SMS information security detection method based on content platform data mining according to claim 1 is characterized in that: Extracting text features of SMS data includes: using an OCR algorithm to extract text paragraphs and text box coordinate information in the SMS data, and comparing the text box coordinates with the SMS unit dialog box coordinates. If the text paragraph is in the SMS unit dialog box, the text paragraph is SMS text, otherwise it is not SMS text.

6. The SMS information security detection method based on content platform data mining according to claim 1 is characterized in that: The SMS summary information that uses the BART model to extract text features includes: converting the input data through Tokenizer; encoding the converted SMS text, and using the pre-trained BART model to process the encoded text to generate a concise summary; using the data in the SMS information security detection knowledge base to fine-tune the BART model to adapt to the SMS data.

7. The method for detecting SMS information security based on content platform data mining according to claim 1, characterized in that: Comparing the embedding vector with the embedding vector in the SMS information security detection knowledge base includes: comparing the embedding vectors of 5 keywords with the keywords in the SMS security detection knowledge base; specifically, calculating the embedding vector of the extracted summary and the summary information of the fraudulent behavior in the knowledge base, using the cosine similarity calculation to generate the similarity between the summary and the knowledge base summary, and finding the knowledge base summary with the highest similarity; if the cosine similarity is greater than the set threshold, the fraudulent behavior is determined to be similar; when a dissimilar fraudulent behavior summary in the knowledge base appears, it is manually reviewed and confirmed, and if it is correct, it is defined as a new type of SMS fraud behavior and updated according to the fraudulent behavior knowledge base data format requirements.

8. The method for detecting SMS information security based on content platform data mining according to claim 7, characterized in that: Set the threshold to 0.

5.

9. A SMS information security detection system based on content platform data mining, the system is used to execute the SMS information security detection method based on content platform data mining according to any one of claims 1 to 8, characterized in that: include: Data collection module, SMS information filtering module and SMS information security detection module; The data collection module is used to collect data information published by users; The SMS information filtering module is used to filter the collected user data information to obtain SMS data; The SMS information security detection module is used to perform information security detection on the filtered SMS data to obtain a detection result.

Images