Short message fraud identification method and system based on machine learning and computer equipment

Abstract

The invention relates to the technical field of short message fraud recognition, and discloses a short message fraud recognition method and system based on machine learning and computer equipment, and the method comprises the steps: carrying out the preprocessing of collected fraud and non-fraud short message samples, and obtaining structured short message data; performing multi-dimensional feature extraction to obtain an initial feature vector; constructing a short message fraud multi-mode knowledge graph; performing feature enhancement to obtain a knowledge enhancement feature vector; inputting the knowledge enhancement feature vector into a plurality of machine learning models for training to obtain an integrated short message fraud recognition model; and performing real-time analysis on the newly received short message based on the integrated short message fraud identification model to obtain a fraud risk prediction result, so that the newly received short message can be quickly analyzed, the real-time requirement in practical application is met, and a risk threshold classification mechanism is adopted, so that the fraud risk prediction result is more interpretable and operable, and the fraud risk prediction accuracy is improved. And subsequent risk management and disposal are facilitated.

Description

Technical Field

[0001] The present invention relates to the technical field of SMS fraud identification, and in particular to a SMS fraud identification method, system and computer equipment based on machine learning. Background Art

[0002] With the rapid development of mobile communication technology and the popularity of smart phones, text messages have become an indispensable means of communication in people's daily lives. However, with the increase in the use of text messages, text message fraud has become increasingly rampant, causing property losses and safety hazards to users. Traditional text message fraud identification methods based on rules and keyword matching can no longer cope with the increasingly complex and varied fraud methods, and their accuracy and real-time performance are difficult to meet actual needs.

[0003] In recent years, machine learning technology has made significant progress in the field of natural language processing, providing a new solution for SMS fraud identification. However, a single machine learning model often fails to fully capture the diverse characteristics of SMS fraud and is easily affected by data noise and model limitations. In addition, most existing SMS fraud identification methods only focus on text features and ignore multimodal information that may be contained in SMS, such as images, URLs, etc., which limits the comprehensiveness and accuracy of identification. On the other hand, knowledge graphs, as a structured knowledge representation method, have shown great potential in multiple fields. However, how to effectively combine knowledge graphs with machine learning models to enhance the performance of SMS fraud identification is still an urgent problem to be solved. At the same time, how to achieve real-time analysis and risk prediction of newly received SMS while ensuring recognition accuracy is also an important challenge facing current research. Summary of the invention

[0004] The present invention provides a method, system and computer equipment for identifying SMS fraud based on machine learning. The present invention can quickly analyze newly received SMS messages, meeting the real-time requirements in practical applications. It adopts a risk threshold classification mechanism to make the fraud risk prediction results more explainable and operational, thus facilitating subsequent risk management and disposal.

[0005] In a first aspect, the present invention provides a method for identifying SMS fraud based on machine learning, the method for identifying SMS fraud based on machine learning comprising: Preprocess the collected fraud and non-fraud SMS samples to obtain structured SMS data; Performing multi-dimensional feature extraction on the structured SMS data to obtain an initial feature vector; Constructing a multimodal knowledge graph of SMS fraud based on the structured SMS data; Using the SMS fraud multimodal knowledge graph to perform feature enhancement on the initial feature vector to obtain a knowledge enhanced feature vector; Inputting the knowledge-enhanced feature vector into multiple machine learning models for training to obtain an integrated SMS fraud identification model; Based on the integrated SMS fraud identification model, newly received SMS messages are analyzed in real time to obtain fraud risk prediction results.

[0006] In a second aspect, the present invention provides a device for identifying SMS fraud based on machine learning, the device for identifying SMS fraud based on machine learning comprising: A preprocessing module, used to preprocess the collected fraud and non-fraud SMS samples to obtain structured SMS data; An extraction module, used for performing multi-dimensional feature extraction on the structured SMS data to obtain an initial feature vector; A construction module, used to construct a multimodal knowledge graph of SMS fraud based on the structured SMS data; An enhancement module, used to perform feature enhancement on the initial feature vector using the SMS fraud multimodal knowledge graph to obtain a knowledge enhanced feature vector; A training module, used for inputting the knowledge-enhanced feature vector into multiple machine learning models for training to obtain an integrated SMS fraud identification model; The analysis module is used to perform real-time analysis on newly received text messages based on the integrated text message fraud identification model to obtain fraud risk prediction results.

[0007] The third aspect of the present invention provides a computer device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the computer device executes the above-mentioned SMS fraud identification method based on machine learning.

[0008] A fourth aspect of the present invention provides a computer-readable storage medium, which stores instructions that, when executed on a computer, enable the computer to execute the above-mentioned SMS fraud identification method based on machine learning.

[0009] In the technical solution provided by the present invention, through multi-dimensional feature extraction and knowledge graph enhancement, the present invention can comprehensively capture the semantics, structure and contextual information of text messages, and improve the richness and discrimination of feature representation. The construction method of multimodal knowledge graph is adopted to effectively integrate text and image information, expand the dimension of knowledge representation, and enhance the ability to understand complex fraud patterns. The use of multiple machine learning models for integrated learning overcomes the limitations of a single model and improves the robustness and generalization ability of fraud identification. The introduction of the Stacking model as a secondary learner realizes the adaptive fusion of prediction results of different models, and further optimizes the final fraud risk prediction results. Through real-time feature extraction and model prediction, the present invention can quickly analyze newly received text messages, meeting the real-time requirements in practical applications. The risk threshold classification mechanism is adopted to make the fraud risk prediction results more explainable and operational, which is convenient for subsequent risk management and disposal. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0011] Figure 1 Schematic diagram of the steps of the method for identifying SMS fraud based on machine learning in an embodiment of the present invention; Figure 2 Schematic diagram of the structure of a device for identifying SMS fraud based on machine learning in an embodiment of the present invention. DETAILED DESCRIPTION

[0012] Embodiments of the present invention provide a method, system and computer device for identifying SMS fraud based on machine learning. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0013] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of the method for identifying SMS fraud based on machine learning in an embodiment of the present invention includes: Step S1, preprocess the collected fraud and non-fraud SMS samples to obtain structured SMS data; It can be understood that the execution subject of the present invention can be a device for identifying SMS fraud based on machine learning, or a terminal or a server. Specifically, it is not limited here. The embodiment of the present invention takes the server as the execution subject as an example for illustration.

[0014] Specifically, remove special characters and punctuation marks from the collected fraud and non-fraud SMS samples, and clean the noise data in the text. In natural language processing, special characters (such as @, #, $, etc.) and punctuation marks (such as full stops, commas, etc.) contribute less to semantic analysis. By removing special characters and punctuation marks, the initially cleaned text data is obtained. Perform word segmentation on the initially cleaned text data, divide the sentence into several independent words, so that the text can be analyzed with words as the basic unit. The text after word segmentation forms a word sequence. Perform stop word filtering. Stop words are words that appear frequently in the text but contribute less to semantic information, such as "de", "shi", "zai", etc. By based on a predefined stop word list, perform stop word filtering on the text sequence after word segmentation, effectively remove irrelevant information, and obtain a keyword sequence containing more meaningful information. Perform part-of-speech analysis on the keyword sequence, label the part of speech of each word, such as noun, verb, adjective, etc. Convert the word sequence with part-of-speech tags into a unified UTF-8 encoding format. Encoding uniformity can ensure that the data can be correctly read and processed in different environments, and avoid garbled problems caused by different encoding formats. Perform length normalization processing on the text data, and adjust the text data to a text sequence of a fixed length. The length normalization method includes truncation and padding. For overly long text, retain a part of the content of the fixed length; for shorter text, use padding characters to expand it to the predetermined length. Construct a term frequency matrix based on the text sequence of the fixed length to obtain a statistical feature representation of the text. The term frequency matrix is constructed by counting the frequency of each word in the text to reflect the vocabulary distribution of the text. The term frequency matrix, as a feature representation method, converts the text into a numerical vector for direct use by a machine learning model. Combine the statistical feature representation with the text sequence of the fixed length to generate the final structured SMS data.

[0015] Step S2, perform multi-dimensional feature extraction on the structured SMS data to obtain an initial feature vector; Specifically, the term frequency-inverse document frequency (TF-IDF) is calculated for the structured SMS data to measure the importance of each word in the SMS. TF-IDF measures the uniqueness of a word by calculating the frequency (TF) of a word in the text and its inverse frequency (IDF) in the entire document set. Common words that are prevalent in most SMS are suppressed, while words with high discrimination in specific SMS are amplified to obtain a TF-IDF feature matrix representing the SMS content. This matrix can generate a set of numerical features for each SMS, allowing the model to quantitatively analyze the vocabulary distribution characteristics in each SMS. Based on the structured SMS data, each word is vectorized to obtain a word embedding feature matrix. Word embedding is a method of mapping words into low-dimensional vectors based on the semantic similarity between words, such as obtained through training models such as Word2Vec or GloVe. Through word embedding, the semantics of words are represented in vector form, so that words with similar semantics are closer in the vector space. The structured SMS data is encoded to extract the contextual semantic representation of the SMS. The encoding method includes using deep learning models such as long short-term memory network (LSTM) and bidirectional encoder representation (BERT) to encode the text messages and obtain the semantic feature vector of the text messages, which helps the model capture the order information between words and the deep semantic relationship in the text. A topic model is built based on structured text message data, and the topic distribution of the text messages is extracted from it. The topic model is a technology used to identify the main topics in the text. Common methods include the latent Dirichlet allocation (LDA) model. By performing topic modeling on the text messages, the topic feature vector is obtained to summarize the core topics of the text messages. The sender information in the structured text message data is statistically analyzed in terms of sending frequency and time distribution to obtain the sending behavior feature vector. These behavioral features reveal the sender's behavior pattern, such as the frequency of sending text messages, the sending time distribution (such as whether it is concentrated in a specific time period), and whether there is batch sending behavior. The URL in the structured text message data is feature extracted. The URL length, domain name reputation (such as through blacklist query), etc. are analyzed to obtain the URL feature vector to help the model identify whether there are potential malicious links. Links with low domain name reputation or abnormal URL length are signs of fraudulent text messages. At the same time, sentiment analysis is performed to extract the sentiment features of the text messages. Sentiment analysis includes the calculation of sentiment polarity and intensity. Sentiment polarity indicates the sentiment tendency of the text message (such as positive, negative or neutral), while sentiment intensity indicates the intensity of the sentiment. Fraudulent text messages usually carry some kind of threat or inducement. By analyzing the sentiment polarity and intensity in the text message, we can identify whether the text message has abnormal emotional characteristics and reveal the intention of fraud. The TF-IDF feature matrix, word embedding feature matrix, semantic feature vector, topic feature vector, behavior feature vector, URL feature vector and sentiment feature vector are concatenated and dimensionally reduced to reduce the feature dimension and thus improve the computational efficiency and robustness of the model, and the initial feature vector is obtained.

[0016] Step S3: construct a multimodal knowledge graph of SMS fraud based on structured SMS data; Specifically, semantic analysis is performed on structured SMS data to extract key concepts and relationships in SMS content. Natural language processing techniques such as word segmentation, part-of-speech tagging, and dependency parsing are used to identify core concepts in the text. The skeleton of the knowledge graph is constructed through a pre-defined fraud domain ontology model, which contains entity types, attributes, and relationship types related to the fraud domain. Based on the knowledge graph skeleton, named entity recognition algorithms and relationship extraction algorithms are applied to structured SMS data to identify specific entities (such as names, places, phone numbers, etc.) in SMS and text content describing the relationships between entities. Through the entity recognition algorithm, entities in SMS are classified and mapped to pre-defined entity types, such as "sender", "receiver", "link", etc. The relationship extraction algorithm is used to extract the relationship descriptions between these entities, such as "send", "contain", etc., and associate them with the corresponding relationship types to obtain the initial entity set and relationship set. The entities in the initial entity set are entity-linked with the pre-built knowledge base to enrich the information of the entities. The process of entity linking involves matching the entities extracted from the SMS with the entities in the knowledge base, and determining the best match by calculating the entity name similarity and context similarity. Similarity calculation usually uses word embedding technology or an algorithm based on edit distance to ensure the accuracy of entity name matching, and uses context information to verify the association between entities. After the matching is completed, the information in the knowledge base is combined to supplement the entity with relevant attribute information, such as historical fraud records, geographic location, etc., to obtain a more comprehensive entity set and relationship set. The initial knowledge graph is constructed based on the enriched entity set and relationship set. The knowledge graph uses entities as nodes in the graph and relationships as edges connecting nodes. At the same time, the descriptive content in the text message text is attached to the graph as attributes of nodes and edges. For example, in the node, an entity such as "phone number" has the attribute "frequently send text messages", while in the edge, the relationship "contains" the additional attribute "text message content". The constructed knowledge graph is a unimodal knowledge graph containing text information. The unimodal graph only uses text information to attach attributes to nodes and edges, so that each entity and relationship has a contextual semantic background to improve the expressiveness of the graph. In order to enhance the multimodal characteristics of the knowledge graph, scene recognition is performed on the image information contained in the structured text message data. Scene recognition uses deep learning image recognition models, such as convolutional neural networks, to extract semantic labels and descriptive text from images. By identifying the scene type, object name, and other information of the image, these image features are represented as semantic labels to extract the semantic features of the image. The image semantic labels and descriptive text are associated with the relevant entities in the unimodal knowledge graph to build a connection between the text entity and the image information. The image semantic information is used as a new node attribute, or the image features are embedded into the graph by connecting the image node with the text node. This makes the graph not only contain text features, but also integrate image information, making it a multimodal knowledge graph.The resulting SMS fraud multimodal knowledge graph integrates both text and image information, making the graph's representation capabilities richer.

[0017] Step S4: using the SMS fraud multimodal knowledge graph to perform feature enhancement on the initial feature vector to obtain a knowledge enhanced feature vector; Specifically, the multimodal knowledge graph of SMS fraud is traversed, and multi-step random walks are carried out starting from the entity corresponding to the initial feature vector. Multi-step random walks are a graph traversal strategy that accesses the surrounding nodes and relationships of the initial entity node to obtain the associated entity and relationship structure. In this way, a subgraph structure containing specific entities and relationships can be formed to reveal the semantic contextual relationship related to the SMS content represented by the initial feature vector. Based on the subgraph structure containing related entities and relationships, the entities and relationships in the graph are embedded in the knowledge graph. Knowledge graph embedding technology is used to map the entities and relationships in the graph to a low-dimensional vector space, so that the nodes and edges in the graph can be represented in numerical form in the vector space so that the model can process and analyze more efficiently. Through knowledge graph embedding, each entity in the subgraph is represented as an entity embedding vector, and each relationship corresponds to a relationship embedding vector. These low-dimensional vectors can capture the semantic associations between entities and relationships and embed them into the vector space, so that the model can use these numerical vectors for feature learning. Aggregation operations are performed on the entity embedding vector and the relationship embedding vector to obtain the overall semantic representation vector of the subgraph. Through aggregation operations, the information of different nodes and edges in the subgraph is fused into an overall representation, which can reflect the semantic features of the subgraph. The node features are updated using information transmission and aggregation mechanisms, so that the representation vector of each node not only depends on its own features, but is also affected by its neighboring nodes. The information transmission process between nodes can utilize the relationship between nodes in the graph structure, and finally obtain a node representation vector that considers the graph structure, so that the feature representation of each node can contain the semantic information of the surrounding nodes. Based on the text and image information in the SMS fraud multimodal knowledge graph, a multimodal fusion network is constructed to fuse the features of different modalities. Text features and image features are combined through a multimodal fusion network. Text features and image features are embedded and converted into a unified vector form. These features are weighted and fused using a multimodal fusion network, so that the features of each modality can be reasonably combined according to their importance to obtain a multimodal fusion feature vector. The initial feature vector is concatenated with the overall semantic representation vector of the subgraph, the node representation vector considering the graph structure, and the multimodal fusion feature vector, and the features from multiple sources are integrated into an extended feature vector, so that the model can integrate multiple features when making classification judgments and enhance the semantic understanding of the text message content. Feature selection is performed on the extended feature vector to remove noise features. Feature selection improves the efficiency and performance of the model by removing redundant features, while retaining features that are important for recognition, and obtaining an optimized extended feature vector. The optimized feature vector is input into the feature fusion network for adaptive weighted fusion. Different features are weighted according to their contribution, so that the final knowledge-enhanced feature vector can contain the most valuable features.

[0018] Step S5: input the knowledge-enhanced feature vector into multiple machine learning models for training to obtain an integrated SMS fraud recognition model; Specifically, the knowledge-enhanced feature vector is input into the random forest model for training. The random forest model is an ensemble learning method based on decision trees, which makes predictions through the integration of multiple decision trees. The random forest model used contains 100 decision trees, the maximum depth of each tree is set to 10, and the number of samples of the minimum leaf node is set to 5. These parameter settings ensure that the model has strong learning ability while avoiding overfitting. By training the random forest model, the random forest prediction result of each SMS sample is obtained, which is used to comprehensively judge whether the SMS has fraud risk through the voting mechanism of multiple trees. The same knowledge-enhanced feature vector is input into the support vector machine (SVM) model for training. The support vector machine is a classification model that is particularly good at processing high-dimensional data. The SVM model uses the radial basis function (RBF) as the kernel function and sets the penalty parameter C to 1.0 to control the model's tolerance for misclassified samples. These parameter settings enable the SVM model to find the best segmentation hyperplane in a complex feature space and accurately identify SMS fraud. By training the support vector machine, the support vector machine prediction result is obtained. The knowledge-enhanced feature vector is input into the gradient boosted decision tree (GBDT) model for training. The GBDT model is a decision tree-based boosting method that uses a gradient descent algorithm to continuously optimize the prediction accuracy of the decision tree. The GBDT model consists of 500 trees, the learning rate is set to 0.1, and the maximum depth of the tree is 5. These settings ensure that the model has a high generalization ability and can effectively capture the nonlinear relationship between features and targets. Through the training of the gradient boosted decision tree, the prediction results of the gradient boosted decision tree are obtained, which reflects the complex relationship between SMS features. At the same time, the long short-term memory network (LSTM) is trained based on the knowledge-enhanced feature vector. LSTM is a neural network structure suitable for processing sequence data, which includes an embedding layer, two LSTM layers, and a fully connected layer. Each LSTM layer contains 128 units to capture the time-dependent features in SMS, and the embedding layer reduces the dimension of the input feature vector to make it suitable for network input. In the LSTM model, the long-term dependency features are effectively retained, so that the model can capture the deep temporal features in the SMS text. After training, the LSTM model outputs the prediction results of the long short-term memory network. The knowledge-enhanced feature vector is input into a convolutional neural network (CNN) for training. The CNN model contains two convolutional layers, using 32 and 64 filters respectively, with a kernel size of 3. In addition, two maximum pooling layers are included to downsample features and reduce data dimensions and computation. The last part of the model contains two fully connected layers, which enables the model to perform deep learning on SMS features. Convolutional neural networks have unique advantages in processing image and text data. Through local feature detection and layer-by-layer abstraction, different levels of features can be extracted from SMS and the prediction results of the convolutional neural network can be output.In the deep learning method, the knowledge-enhanced feature vector is input into the Transformer model for training. The Transformer model contains 6 encoder layers, each with 8 attention heads and a hidden layer size of 512. The multi-head attention mechanism of the Transformer enables it to capture the complex patterns and contextual relationships in SMS, thereby improving the ability to understand the content of SMS. By embedding the feature vector, the Transformer model outputs the Transformer prediction results with rich semantic information. The knowledge-enhanced feature vector is input into the graph convolutional network (GCN) for training. The GCN model uses graph structure information for feature learning and contains two graph convolution layers, using 64 and 32 feature maps respectively. The model embeds node features into a low-dimensional space through graph convolution and updates the node representation layer by layer, making full use of the graph structure information in the SMS multimodal knowledge graph. Through the training of the graph convolutional network, the prediction results of the graph convolutional network are obtained. The prediction results of random forest, support vector machine, gradient boosting decision tree, long short-term memory network, convolutional neural network, transformer and graph convolutional network are weighted averaged to obtain the integrated prediction results. In order to improve the integration effect, a Stacking model is constructed, and the prediction results of each model are used as features to input the logistic regression model. Logistic regression is used as a secondary learner to re-learn based on the prediction results of each model, and the classification effect of the overall model is improved by automatically adjusting the weight of each model. The Stacking model outputs an integrated SMS fraud recognition model.

[0019] Step S6: Based on the integrated SMS fraud identification model, the newly received SMS is analyzed in real time to obtain a fraud risk prediction result.

[0020] Specifically, the SMS data is preprocessed and multi-dimensional features are extracted. The preprocessing includes text cleaning, word segmentation, stop word removal, part-of-speech tagging, etc. to generate structured text data. On this basis, multi-dimensional feature extraction is performed to construct a real-time feature vector, including TF-IDF, word embedding features, semantic features, behavioral features, sentiment features, and topic features, so that the important information in the SMS can be represented by numerical vectorization. After the feature extraction is completed, the real-time feature vector is enhanced through the SMS fraud multimodal knowledge graph. The graph stores entity and relationship information related to fraudulent SMS, which is used to contextually expand the real-time features, so that the final real-time enhanced feature vector can contain more semantic content and associated features related to fraud. The real-time enhanced feature vector is input into each sub-model of the integrated SMS fraud identification model for prediction. The real-time enhanced feature vector is input into the random forest model to obtain the first fraud probability prediction value. The random forest model estimates the fraud probability of SMS through the voting mechanism of multiple decision trees, thereby providing a judgment result based on a multi-tree combination for the overall integrated model. The real-time enhanced feature vector is input into the support vector machine (SVM) model to generate the second fraud probability prediction value. The SVM model projects the features into a high-dimensional space through kernel function mapping, which can capture the nonlinear relationship between SMS texts and enhance the integrated model's ability to identify fraud SMS. The real-time enhanced feature vector is input into the gradient boosted decision tree (GBDT) model to obtain the third fraud probability prediction value. The GBDT model is iteratively constructed through a series of weak learners, continuously optimizing the classification boundary, and can accurately fit the complex features of SMS content. At the same time, the real-time enhanced feature vector is input into the long short-term memory network (LSTM) for time series analysis to generate the fourth fraud probability prediction value. The LSTM model is good at capturing the contextual relationship of the text. Its advantage in processing time series features can identify the implicit dynamic semantic information in the SMS and support the fraud identification ability of the integrated model. In order to enhance the model's hierarchical extraction of features, the real-time enhanced feature vector is input into the convolutional neural network (CNN) model and the Transformer model to obtain the fifth and sixth fraud probability prediction values, respectively. The CNN model can capture local information of SMS features through convolution operations, and extract the main patterns in the text through the pooling layer to generate efficient feature representation. The Transformer model uses a multi-head self-attention mechanism, which can pay attention to both global and local information in SMS. Its multi-layer structure gives the model an advantage in processing long text features. The real-time enhanced feature vector is input into the graph convolutional network (GCN) to extract the graph structure information and obtain the seventh fraud probability prediction value. The graph convolutional network can aggregate node information using the adjacency relationship in the knowledge graph, so that the model can make full use of the correlation information in the SMS and the knowledge graph when generating feature representation.The first fraud probability prediction value, the second fraud probability prediction value, the third fraud probability prediction value, the fourth fraud probability prediction value, the fifth fraud probability prediction value, the sixth fraud probability prediction value and the seventh fraud probability prediction value are input into the logistic regression layer for weighted fusion. The logistic regression layer acts as a secondary learner, and can adaptively adjust the weight of each model in the final prediction by learning the feature combination output by different sub-models. The output of the logistic regression layer is the target fraud probability prediction value, which is the comprehensive probability obtained by weighting the fraud prediction results of each model. The target fraud probability prediction value can reflect the overall risk of the SMS being judged as fraud. The target fraud probability prediction value is compared with the preset risk threshold to complete the classification task. An appropriate threshold, such as 0.5 or 0.7, is set to classify the fraud risk of the SMS. If the target fraud probability prediction value exceeds this threshold, the SMS is judged as a high-risk fraud, otherwise it is judged as a normal SMS. In this way, the integrated SMS fraud identification model can perform real-time analysis on newly received SMS and generate accurate fraud risk prediction results, thereby effectively identifying potential fraud information and providing users with timely security warnings.

[0021] In the embodiment of the present invention, through multi-dimensional feature extraction and knowledge graph enhancement, the present invention can fully capture the semantics, structure and context information of SMS, and improve the richness and discrimination of feature representation. The construction method of multimodal knowledge graph is adopted to effectively integrate text and image information, expand the dimension of knowledge representation, and enhance the ability to understand complex fraud patterns. The use of multiple machine learning models for integrated learning overcomes the limitations of a single model and improves the robustness and generalization ability of fraud identification. The introduction of the Stacking model as a secondary learner realizes the adaptive fusion of prediction results of different models, and further optimizes the final fraud risk prediction results. Through real-time feature extraction and model prediction, the present invention can quickly analyze newly received SMS, meeting the real-time requirements in practical applications. The risk threshold classification mechanism is adopted to make the fraud risk prediction results more explainable and operational, which is convenient for subsequent risk management and disposal.

[0022] In a specific embodiment, the process of executing step S1 may specifically include the following steps: Special characters and punctuation marks are removed from the collected fraud and non-fraud SMS samples to obtain preliminary cleaned text data, and the preliminary cleaned text data is segmented to obtain a text sequence after segmentation; Based on the predefined stop word list, the text sequence after word segmentation is filtered for stop words to obtain a keyword sequence, and the keyword sequence is analyzed for part of speech to obtain a word sequence with part of speech tags; Convert the sequence of words with part-of-speech tags into a unified UTF-8 encoding format to obtain text data with unified encoding, and perform length normalization processing on the text data with unified encoding to obtain a text sequence of fixed length; Construct a word frequency matrix based on the text sequence of fixed length to obtain a statistical feature representation of the text, and combine the statistical feature representation with the text sequence of fixed length to obtain structured SMS data.

[0023] Specifically, preprocess the collected fraud and non-fraud SMS samples, convert the original SMS text data into a structured format for subsequent feature extraction and model training. Remove special characters and punctuation marks from the SMS text. Special characters include symbols such as "@", "#", "$", etc., and punctuation marks such as full stops, commas, quotation marks, etc. These symbols usually have no practical meaning in text semantics. By removing unnecessary characters, simplify the text structure, retain the core words in the text, and obtain the text data after preliminary cleaning. Perform word segmentation on the text data after preliminary cleaning. Cut continuous text sentences into independent words. The text sequence after word segmentation takes words as the basic unit to extract important information in the SMS content. Filter out stop words from the text sequence after word segmentation. Stop words refer to words that appear frequently in the language but contribute less to the main semantics of the text, such as "de", "shi", "zai", etc. Based on a predefined stop word list, remove common but meaningless words from the text sequence after word segmentation. Through stop word filtering, redundant information in the text data is removed, leaving keywords that contribute importantly to the semantics. Perform part-of-speech analysis and assign part-of-speech tags to each keyword, such as nouns, verbs, adjectives, etc. To ensure the generality and consistency of the text data, convert the sequence of words with part-of-speech tags into a unified UTF-8 encoding format. UTF-8 is a character encoding standard that can be compatible with various languages and symbols, ensuring the readability and consistency of data in different environments. After conversion to UTF-8 encoding, ensure that subsequent processing steps are not interfered by character encoding, and the text data can be stored and transmitted stably. Perform length normalization processing on the text data with unified encoding. By truncating and padding, adjust all SMS sequences to a fixed length. If the length of a certain SMS exceeds the set maximum length, retain its first N words by truncation; if the SMS is shorter, pad it by adding placeholders at the end. Construct a word frequency matrix based on the text sequence of fixed length. The word frequency matrix is constructed based on the frequency of words appearing in the text, using term frequency-inverse document frequency (TF-IDF). The calculation formula for term frequency (TF) is: ; where, represents the word in the SMS word frequency, Yes word In SMS The number of times it appears in It's a text message The total number of words in the text message. The inverse document frequency (IDF) measures the prevalence of a word in all text messages. The formula is: ; in, is the total number of SMS samples, Contains words By and The TF-IDF value is multiplied together, and the final word frequency matrix can reflect the importance of each word in the text message. If a word appears frequently in many text messages, its IDF value is low, while important words that only appear in a few text messages will obtain a higher IDF value. The word frequency matrix constructed by the above formula is a statistical feature representation of the text, which can quantify the word distribution characteristics of each text message. The statistical feature representation is combined with a fixed-length text sequence to form the final structured text message data.

[0024] In a specific embodiment, the process of executing step S2 may specifically include the following steps: Perform word frequency-inverse document frequency calculation on structured SMS data to obtain the TF-IDF feature matrix of the text, and then vectorize each word based on the structured SMS data to obtain the word embedding feature matrix; Encode the structured SMS data, extract the contextual semantic representation, obtain the semantic feature vector, build a topic model based on the structured SMS data, and extract the topic distribution of SMS to obtain the topic feature vector; The frequency and time distribution of the sender information in the structured SMS data are statistically analyzed to obtain the behavior feature vector. Based on the URL information in the structured SMS data, the domain name reputation and URL length features are extracted to obtain the URL feature vector. The sentiment polarity and intensity of the structured SMS data are calculated to obtain the sentiment feature vector. The TF-IDF feature matrix, word embedding feature matrix, semantic feature vector, topic feature vector, behavior feature vector, URL feature vector and sentiment feature vector are concatenated and dimensionally reduced to obtain the initial feature vector.

[0025] Specifically, we calculate the term frequency-inverse document frequency (TF-IDF) of structured SMS data to quantify the importance of each word in the SMS text. The TF-IDF feature matrix can reflect the frequency of each word in a specific SMS and the prevalence of the word in the entire SMS data set, thereby suppressing more common words and increasing the weight of important words. In SMS The calculation formula is as follows: ; in, Expressive words In SMS The number of occurrences in It's a text message The total number of words in the text message set. IDF (Inverse Document Frequency) is used to measure the prevalence of a word in the entire text message set. The formula is: ; in, Indicates the total number of SMS samples, Contains words The number of short messages. By multiplying the word frequency and the inverse document frequency, the TF-IDF value is obtained to form the TF-IDF feature matrix of each short message: ; This matrix can map the words in each text message into a set of numerical features, so as to represent and understand the content of the text message. Each word in the text message is embedded. Word embedding is a technique for mapping words into vectors, mapping similar words to similar vector space positions, such as using methods such as Word2Vec or GloVe. Through word embedding, a word embedding feature matrix is ​​generated to capture the semantic relationship between words, so that the word information in the text message is represented in a vectorized manner. At the same time, the text message data is encoded to extract contextual semantic representation. Using a deep learning model, the sentences in the text message are encoded into semantic feature vectors. The encoding process involves convolution and embedding of multiple layers of neural networks to capture the semantic features and contextual relationships in the text message. For example, the BERT model can incorporate contextual information into the semantic representation of each word through its self-attention mechanism, improving the model's ability to understand the content of the text message. Through contextual semantic extraction, a semantic feature vector can be formed. In order to extract the semantic topic features of the text message, a topic model is constructed based on the structured text message data. Topic models (such as LDA, latent Dirichlet allocation) identify different topics through the vocabulary distribution of the text message and generate a topic distribution for each text message. The LDA model uses Bayesian inference to generate the topic distribution of each word. The calculation process is expressed as: ; in, It's in text message Chinese word generation The probability of is the number of topics, Indicated in the topic Next word The probability of It means SMS Belong to the theme The probability of a message being sent to a recipient is quantified. The topic model is used to generate a topic feature vector, which can reveal the potential topic of the text message content and provide the recognition model with the distribution information of the text message topic. The behavior and metadata features of the text message are extracted. The sender information in the text message is statistically analyzed to obtain its sending frequency and time distribution. By calculating the time distribution of the text message, the sender's active time period is identified and a behavior feature vector is generated. For example, if a certain sending number sends text messages with an abnormally high frequency in a specific time period, it is judged that the number is involved in fraudulent activities. The behavior feature vector quantifies the sender's activity pattern, enabling the model to identify potential abnormal behaviors. If the text message contains URL information, the relevant features of the URL are analyzed. By extracting the domain name reputation and length of the URL, potential suspicious links are revealed. The domain name reputation is obtained by querying the blacklist database or using the reputation scoring service, while the URL length is directly calculated by the string length. Combined with this information, a URL feature vector is generated to provide the model with link risk information in the text message. For emotional features, the text message text is analyzed for polarity and intensity through the sentiment analysis model. Emotional polarity indicates the emotional tendency of the text message (such as positive, negative, neutral), and emotional intensity reflects the intensity of the emotion. By calculating the emotional features, we can identify whether the text message is threatening or misleading, and improve the recognition accuracy. The emotional feature vector can provide the model with emotional information of the text message, so that the model can more accurately judge the tone and emotional intention of the text message. The TF-IDF feature matrix, word embedding feature matrix, semantic feature vector, topic feature vector, behavior feature vector, URL feature vector and emotional feature vector are concatenated to form a feature vector containing multi-dimensional information. The concatenated feature vector is subjected to dimensionality reduction processing to simplify the model complexity. The principal component analysis method is used to project the high-dimensional feature vector into a low-dimensional space, generate a compressed feature representation, and obtain the initial feature vector.

[0026] In a specific embodiment, the process of executing step S3 may specifically include the following steps: Perform semantic analysis on structured SMS data, extract key concepts and relationships, and build a knowledge graph skeleton containing entity types, attributes, and relationship types based on a predefined fraud domain ontology model; Based on the knowledge graph skeleton, named entity recognition algorithm and relationship extraction algorithm are applied to structured SMS data to identify entity and relationship descriptions in SMS, and map them to corresponding entity types and relationship types to obtain the initial entity set and relationship set; Entities in the initial entity set are linked to the pre-built knowledge base, the best matching entity is determined by calculating entity name similarity and context similarity, and relevant attribute information is extracted from the knowledge base to obtain an enriched entity set and relationship set; Based on the enriched entity set and relationship set, an initial knowledge graph is constructed, where entities are used as nodes in the graph and relationships are used as edges. The original descriptions in the SMS text are used as attributes of nodes and edges to obtain a unimodal knowledge graph containing text information. Scene recognition is performed on the image information contained in the structured SMS data to obtain image semantic labels and description texts. The image semantic labels and description texts are then associated with relevant entities in the unimodal knowledge graph. A connection is established between text entities and image information. Image features are used as new node attributes to obtain a multimodal knowledge graph for SMS fraud.

[0027] Specifically, semantic analysis is performed on structured SMS data to extract important concepts and relationships in SMS. Semantic analysis uses natural language processing technology to identify specific words and phrases in SMS and determine the semantic relationships between them. The skeleton of the knowledge graph is constructed based on the predefined fraud domain ontology model. The ontology model is a semantic structure that defines relevant entity types, attributes and their relationship types in the domain. For example, in the fraud domain, the ontology model includes entity types such as "phone number", "bank account", "remittance behavior", and relationship types such as "involved" and "connected to". Through the skeleton structure, the knowledge graph can clearly identify common fraud-related concepts in SMS during the analysis process. Based on the skeleton of the knowledge graph, the named entity recognition (NER) algorithm and the relationship extraction algorithm are applied to the structured SMS data. The NER algorithm can identify entities in SMS, such as phone numbers, URLs, account names, etc., and map them to the corresponding entity types in the knowledge graph. The relationship extraction algorithm is used to extract the relationship descriptions between these entities from the SMS text and map them to the relationship types of the knowledge graph to obtain an initial entity set and relationship set, which provide basic building blocks for building the knowledge graph. Entities in the initial entity set are linked to the pre-built knowledge base. Entities in the text of the SMS are matched with entities in the knowledge base. By calculating entity name similarity and context similarity, the knowledge base entity that best matches the SMS entity is identified. The similarity is calculated using the cosine similarity formula: ; in, and Represent the feature vectors of SMS entities and knowledge base entities respectively, and represents their inner product, and Respectively represent their vector lengths. By calculating the similarity, the knowledge base entity with the highest similarity is selected as the matching object. The matching result is confirmed by context similarity, such as comparing the features of the sentence where the SMS entity is located with the features of the text where the knowledge base entity is located. After determining the matching entity, the relevant attribute information of the entity is extracted from the knowledge base, such as the bank to which the account belongs and the account status, to obtain an enriched entity set and relationship set, so that the knowledge graph can contain more context information. Based on the enriched entity set and relationship set, the initial knowledge graph is constructed. In the knowledge graph, entities will be represented as nodes in the graph, and relationships will be used as edges connecting nodes. At the same time, the original description in the SMS text is attached to the knowledge graph as the attributes of the nodes and edges, so that the graph contains structured entity relationship information and a detailed semantic description of the text. In this way, the initial knowledge graph can carry rich SMS information and become a unimodal knowledge graph. In order to enhance the expressiveness of the knowledge graph, the image information contained in the structured SMS data is processed and incorporated into the multimodal graph. Assuming that an image is attached to the SMS, the image content is scene recognized through the deep learning model to extract the semantic label and description text of the image. By associating the labels and description texts with the relevant entities in the unimodal knowledge graph, the connection between the text information and the image information in the SMS is established. The image features are used as new node attributes so that each node in the graph not only stores text attributes but also contains image features. The resulting multimodal knowledge graph integrates text and image information. Through multimodal fusion, the knowledge graph can use information sources of multiple modalities such as text and images when identifying SMS fraud. The graph is embedded through models such as graph convolutional networks, and the graph structure information is converted into a vector representation for use in machine learning models. Graph embedding is calculated using the following formula: ; in, Representation Node In the The embedding representation of the layer, Representation Node The set of neighbor nodes of is the normalized coefficient in the adjacency matrix, For the The weight matrix of the layer, and Then is the activation function. Through this formula, the embedded representation of the node is generated in the multimodal graph, thus providing rich feature input for the model.

[0028] In a specific embodiment, the process of executing step S4 may specifically include the following steps: The multimodal knowledge graph of SMS fraud is traversed, starting from the entity corresponding to the initial feature vector, and performing multi-step random walks to obtain a subgraph structure containing related entities and relationships; Based on the subgraph structure containing related entities and relationships, the entities and relationships in the graph are embedded in the knowledge graph, and the entities and relationships are mapped to a low-dimensional vector space to obtain entity embedding vectors and relationship embedding vectors; Aggregate the entity embedding vector and the relationship embedding vector to obtain the overall semantic representation vector of the subgraph, and transfer and aggregate the nodes in the subgraph structure to obtain the node representation vector that takes the graph structure into consideration. Based on the text and image information in the SMS fraud multimodal knowledge graph, a multimodal fusion network is constructed to fuse the features of different modalities and obtain a multimodal fusion feature vector. The initial feature vector is concatenated with the overall semantic representation vector of the subgraph, the node representation vector considering the graph structure, and the multimodal fusion feature vector to obtain an extended feature vector. Feature selection is performed on the extended feature vector to remove redundant and irrelevant features to obtain the optimized extended feature vector, which is then input into the feature fusion network to perform adaptive weighted fusion on features from different sources to obtain the knowledge enhanced feature vector.

[0029] Specifically, we traverse the SMS fraud multimodal knowledge graph, starting from the entity corresponding to the initial feature vector, and perform multi-step random walks. Random walks are a technique for traversing nodes in a graph. By randomly selecting the next node, we can obtain the contextual structure information around the current node within a certain number of steps. , starting from the initial entity node Random walks are performed to obtain multiple entities and relationships associated with the entity and to construct a subgraph structure. In this way, the local semantic network of the entity is obtained, and it contains entities and relationships related to it. Based on the subgraph structure containing related entities and relationships, the entities and relationships in the graph are embedded in the knowledge graph, and the entities and relationships in the subgraph are mapped to a low-dimensional vector space, so that similar entities and relationships in the vector space have similar representations. For each entity , through an embedding matrix Map it into a low-dimensional vector space, for example, by the formula: ; in, Representing Entities The low-dimensional embedding vector of is the embedding matrix, which contains the vector representation of all entities. Similarly, for the relationship , through an embedding matrix Mapping to a low-dimensional space: ; in, Representing relationships The embedding vector of is the embedding matrix of the relationship, which can map the relationship to the same low-dimensional space as the entity. The embedding vector effectively captures the semantic connection between the entity and the relationship. Aggregate the entity embedding vector and the relationship embedding vector to obtain the overall semantic representation vector of the subgraph. The aggregation operation uses the average or weighted average method, for example, through the formula: ; in, represents the overall semantic representation vector of the subgraph, is the set of entities contained in the subgraph, and Represent entities and the embedding vectors of their corresponding relations. This aggregation method integrates the features of each entity and relation in the subgraph to generate an overall vector representation that reflects the semantic features of the subgraph. In order to pass information in the subgraph structure, nodes are passed and aggregated, taking into account the features of their adjacent nodes. The message passing mechanism in the graph neural network is used to update the nodes. The embedding vector ; In this formula, Indicated in Nodes in a layer The characteristic vector of Is a node The set of neighbor nodes of and Representation Node and The degree of It is The weight matrix of the layer, is an activation function (such as ReLU). Through this process, each node in the subgraph structure contains its own features and the information of its neighboring nodes, forming a comprehensive node representation vector. In order to utilize multimodal features, multimodal fusion is performed on the text and image information in the SMS fraud knowledge graph. A multimodal fusion network is constructed to perform cross-modal feature learning using text and image features. Word embedding or BERT and other models are used to encode text features, and convolutional neural networks (CNN) are used to encode image features. Then, vectors of different modalities are input into the multimodal fusion network for integration. The attention mechanism can effectively capture the interaction between features of different modalities. For example, for the multimodal fusion feature vector , using the attention mechanism to fuse text features t and image features : ; in, and The weighted coefficients representing the text features and image features are obtained through learning. In this way, the fused multimodal feature vector can comprehensively utilize the information of text and image to provide a more comprehensive feature expression. After obtaining the overall semantic representation vector of the subgraph, the node representation vector considering the graph structure, and the multimodal fusion feature vector, they are concatenated with the initial feature vector to form an extended feature vector. Feature selection is performed on the extended feature vector to remove redundant or irrelevant features to obtain the optimized extended feature vector. The high-dimensional feature vector is reduced in dimension using methods such as principal component analysis, or the noise features are removed using the L1 regularization method. The optimized extended feature vector is input into the feature fusion network, which adaptively performs weighted fusion of features from different sources to generate a knowledge-enhanced feature vector. The feature fusion network adaptively adjusts the weights according to the contribution of different features, so that the knowledge-enhanced feature vector finally generated can fully express the key features of the SMS.

[0030] In a specific embodiment, the process of executing step S5 may specifically include the following steps: The knowledge-enhanced feature vector is input into the random forest model for training, where the random forest model contains 100 decision trees, the maximum depth of each decision tree is 10, and the minimum number of leaf node samples is 5, and the random forest prediction results are obtained; The knowledge-enhanced feature vector is input into the support vector machine model for training, where the support vector machine model uses a radial basis function kernel and the penalty parameter C is set to 1.0 to obtain the support vector machine prediction result; The knowledge-enhanced feature vector is input into the gradient boosting decision tree model for training, where the gradient boosting decision tree model contains 500 trees, the learning rate is set to 0.1, and the maximum depth is 5, and the prediction results of the gradient boosting decision tree are obtained; Based on the knowledge-enhanced feature vector, the long short-term memory network model is trained. The long short-term memory network contains an embedding layer, two LSTM layers and a fully connected layer. Each LSTM layer contains 128 LSTM units. The prediction results of the long short-term memory network are obtained. The knowledge-enhanced feature vector is input into the convolutional neural network model for training, where the convolutional neural network contains two convolutional layers with 32 and 64 filters respectively, a kernel size of 3, two maximum pooling layers and two fully connected layers, and the convolutional neural network prediction results are obtained; The knowledge-enhanced feature vector is input into the Transformer model for training. The Transformer model contains 6 encoder layers, each with 8 attention heads, and the hidden layer size is 512. The Transformer prediction result is obtained; A graph convolutional network model is trained based on the knowledge-enhanced feature vector, where the graph convolutional network contains two graph convolutional layers with 64 and 32 feature maps respectively and a fully connected layer to obtain the graph convolutional network prediction results; The prediction results of random forest, support vector machine, gradient boosting decision tree, long short-term memory network, convolutional neural network, transformer and graph convolutional network are weighted averaged to obtain the integrated prediction result. A Stacking model is constructed based on the integrated prediction results. Logistic regression is used as the secondary learner to re-learn the prediction results of each model to obtain an integrated SMS fraud identification model.

[0031] Specifically, the knowledge-enhanced feature vector is input into the random forest model for training. Random forest is an ensemble learning method that performs classification by constructing a large number of decision trees and combining a voting mechanism. The random forest model contains 100 decision trees, and the maximum depth of each tree is set to 10 to prevent the model from overfitting. At the same time, the minimum number of leaf node samples is set to 5 to ensure that the model can adapt to the diversity of data. After training, each decision tree makes classification predictions for the input samples, and finally generates the final prediction results through a majority voting mechanism. The prediction results of random forest are expressed by the following formula: ; in, is the predicted value of random forest, represents the number of trees, It is A decision tree is used for the input feature vector The predicted value of random forest is obtained by combining the prediction results of multiple trees. The knowledge-enhanced feature vector is input into the support vector machine (SVM) model for training. SVM is a classifier suitable for processing high-dimensional data. The SVM model uses the radial basis function kernel (RBF kernel) and sets the penalty parameter Set to 1.0 to control the model's tolerance for misclassified samples. The decision boundary of SVM is expressed by the following formula: ; in, represents the prediction result of SVM, is the number of support vectors, and are the weights and labels of the support vectors respectively is the kernel function, which represents the support vector With the input feature vector The similarity of is the bias term. In this way, the SVM model is able to generate classification prediction values ​​for fraudulent text messages. The knowledge-enhanced feature vector is input into the gradient boosted decision tree (GBDT) model for training. The GBDT model achieves prediction through gradient descent optimization of a series of decision trees, using 500 trees and a learning rate of 0.1 to ensure that the model gradually optimizes the objective function during training. The prediction value of the GBDT model is expressed by the following formula: ; in, Represents the prediction result of GBDT, is the number of trees, Indicates The stride length of a tree, It is Trees for input prediction. By combining the prediction results of multiple trees, GBDT can capture more complex feature relationships and thus generate accurate classification results. In order to capture the temporal relationship of SMS sequence data, the knowledge-enhanced feature vector is input into the long short-term memory network (LSTM) model for training. LSTM is a neural network structure suitable for processing sequence data. The LSTM model consists of an embedding layer, two LSTM layers and a fully connected layer, and each LSTM layer contains 128 units. The LSTM model captures the long-term dependency of the time series through the remember and forget gate mechanism to generate prediction results for the SMS content. The knowledge-enhanced feature vector is input into the convolutional neural network (CNN) for training. The CNN model consists of two convolutional layers, using 32 and 64 filters respectively, and the size of each convolution kernel is set to 3. The convolutional layer is followed by two maximum pooling layers to downsample features and reduce the amount of calculation. The output of the convolutional layer is mapped to the classification label through two fully connected layers. CNN can effectively extract local patterns in SMS through local feature detection and multi-layer abstraction, and finally generate classification prediction results. In the deep learning model, the knowledge-enhanced feature vector is input into the Transformer model for training. The Transformer model consists of 6 encoder layers, each with 8 attention heads and a hidden layer size of 512. The Transformer model can capture both global and local information in the text message through the self-attention mechanism, so that the model can generate classification results with rich semantic information. The output representation of the Transformer is context-dependent, which can effectively improve the classification accuracy. The knowledge-enhanced feature vector is input into the graph convolutional network (GCN) for training. The GCN model contains two graph convolutional layers, which contain 64 and 32 feature maps respectively. GCN aggregates nodes through the adjacency relationship in the graph structure, so that the feature representation of each node can contain the information of the surrounding nodes. The output of the graph convolutional layer is mapped to the classification label through the fully connected layer to generate the classification prediction result. After obtaining the prediction results of each model, a weighted average is performed to generate an integrated prediction result. The weights of different models are set so that the more accurate model has a higher weight, thereby improving the overall effect of the integrated model. The result of the weighted average can make full use of the advantages of each model to generate a more reliable prediction result. In order to improve the performance of the model, a Stacking model is constructed based on the integrated prediction result. Stacking is an integrated learning method that uses the prediction results of multiple basic models as the input of the secondary learner for re-learning. Logistic regression is used as the secondary learner to integrate the prediction outputs of each model and perform the final classification. The logistic regression model can generate the optimal classification result by learning the relationship between the prediction results of different models and the target label, and finally obtain an integrated SMS fraud recognition model based on Stacking.

[0032] In a specific embodiment, the process of executing step S6 may specifically include the following steps: Preprocess and extract multi-dimensional features of newly received SMS to obtain real-time feature vectors, and use SMS fraud multimodal knowledge graph to enhance the real-time feature vectors to obtain real-time enhanced feature vectors; Input the real-time enhanced feature vector into the random forest model in the integrated SMS fraud identification model to obtain a first fraud probability prediction value, and input the real-time enhanced feature vector into the support vector machine model in the integrated SMS fraud identification model to obtain a second fraud probability prediction value; Based on the real-time enhanced feature vector, a gradient boosting decision tree model in the integrated SMS fraud identification model is used to make a prediction to obtain a third fraud probability prediction value, and the real-time enhanced feature vector is input into a long short-term memory network model in the integrated SMS fraud identification model to obtain a fourth fraud probability prediction value; Applying the convolutional neural network model and the Transformer model in the integrated SMS fraud identification model to the real-time enhanced feature vector, respectively obtaining a fifth fraud probability prediction value and a sixth fraud probability prediction value, and using the graph convolutional network model in the integrated SMS fraud identification model to make predictions based on the real-time enhanced feature vector, obtaining a seventh fraud probability prediction value; Input the first fraud probability prediction value, the second fraud probability prediction value, the third fraud probability prediction value, the fourth fraud probability prediction value, the fifth fraud probability prediction value, the sixth fraud probability prediction value and the seventh fraud probability prediction value into the logistic regression layer for weighted fusion to obtain a target fraud probability prediction value; The target fraud probability prediction value is classified based on the preset risk threshold to obtain the fraud risk prediction result.

[0033] Specifically, the newly received SMS is preprocessed and multi-dimensional feature extracted to generate a real-time feature vector. The preprocessing steps include removing special characters, word segmentation, stop word filtering, etc., to ensure the consistency of SMS text data format and remove noise. The SMS content is deeply analyzed through multi-dimensional feature extraction. This process includes calculating the TF-IDF value to quantify the importance of words in SMS; generating word embeddings to capture the semantic similarity between words; extracting sentiment features, topic features, behavior features, URL features, etc. through natural language processing methods. These features are combined to form a real-time feature vector of the SMS. The real-time feature vector is input into the SMS fraud multimodal knowledge graph for feature enhancement. The knowledge graph provides semantic associations about fraud entities (such as bank accounts, phone numbers, URLs, etc.). By matching with nodes and relationships in the knowledge graph, the real-time feature vector can obtain the contextual relationship of the SMS content. The feature enhancement process uses graph traversal and embedding technology to enhance the representation ability of the vector. Through the graph embedding method, the vector of each entity can be updated in combination with the information of its surrounding nodes, so that the enhanced feature vector more accurately reflects the fraud characteristics and generates a real-time enhanced feature vector. The real-time enhanced feature vector is input into each sub-model in the integrated SMS fraud identification model. It is input into the random forest model to obtain the first fraud probability prediction value. The random forest obtains the result through the voting mechanism of 100 decision trees. The output of each tree is regarded as a vote on whether the SMS is a fraud, and finally the formula is used: ; in, is the output fraud probability prediction value of random forest, is the number of decision trees (i.e. 100), and Indicates The output of the tree. The combination of multiple trees greatly improves the classification accuracy and generates the first fraud probability prediction value. The real-time enhanced feature vector is input into the support vector machine (SVM) model to obtain the second fraud probability prediction value. The kernel function of the SVM model uses the radial basis function (RBF), which has the ability to process high-dimensional data. The SVM model performs classification by constructing a hyperplane that maximizes the interval between the two classes. The formula is expressed as: ; in, represents the output probability of SVM, is the weight of the support vector, It's a label. is the kernel function, is the bias term. By passing the output value of SVM to the sigmoid function, the second fraud probability prediction value is obtained. Based on the real-time enhanced feature vector, the gradient boosted decision tree (GBDT) is used for prediction. GBDT is an ensemble method based on gradient descent optimization. It realizes prediction by building 500 small decision trees, and its learning rate is set to 0.1. The prediction formula of GBDT is as follows: ; in, is the output probability of GBDT, represents the number of trees (i.e. 500), is the learning rate, For the The prediction value of each tree. Each tree is trained by the residual of the previous tree, so that the model can capture nonlinear features, and the third fraud probability prediction value is obtained. The real-time enhanced feature vector is input into the long short-term memory network (LSTM) model, which is a neural network structure for processing sequence data. The memory unit in the LSTM model captures the temporal dependency in the text message content. A time series output is generated by the calculation of multiple LSTM units, and these outputs are mapped to the classification probability through the fully connected layer to generate the fourth fraud probability prediction value. The real-time enhanced feature vector is input into the convolutional neural network (CNN) model, which extracts the local pattern of the text message features through a series of convolutional layers. The CNN model contains two convolutional layers, using 32 and 64 filters respectively, and the size of each convolution kernel is set to 3. The convolutional layer is followed by a maximum pooling layer, which maps the local features of the text message to the global representation through layer-by-layer abstraction. The pooled features are passed through the fully connected layer to obtain the fifth fraud probability prediction value. The real-time enhanced feature vector is input into the Transformer model for prediction. Transformer uses a multi-layer self-attention mechanism to capture global and local information in SMS. Its structure includes 6 encoder layers, each containing 8 attention heads. Through the attention mechanism, Transformer can understand the content of SMS more comprehensively, thereby outputting the sixth fraud probability prediction value. The real-time enhanced feature vector is input into the graph convolutional network (GCN) for prediction. GCN aggregates node information through adjacency relationships. The model contains two graph convolution layers, using 64 and 32 feature maps respectively, and outputs the seventh fraud probability prediction value. The first fraud probability prediction value, the second fraud probability prediction value, the third fraud probability prediction value, the fourth fraud probability prediction value, the fifth fraud probability prediction value, the sixth fraud probability prediction value and the seventh fraud probability prediction value are input into the logistic regression layer for weighted fusion. The logistic regression layer generates the optimal combination weight by learning the prediction results of different sub-models, and outputs the final fraud probability prediction value. The target fraud probability prediction value is classified and judged according to the preset risk threshold. If the target fraud probability prediction value is greater than or equal to the threshold (such as 0.5), the SMS is marked as "high-risk fraud"; otherwise it is marked as "normal".

[0034] The above describes the SMS fraud identification method based on machine learning in the embodiment of the present invention. The following describes the SMS fraud identification device based on machine learning in the embodiment of the present invention. Figure 2 In one embodiment of the present invention, a device for identifying SMS fraud based on machine learning includes: A preprocessing module, used to preprocess the collected fraud and non-fraud SMS samples to obtain structured SMS data; An extraction module is used to extract multi-dimensional features from structured SMS data to obtain an initial feature vector; A construction module for building a multimodal knowledge graph of SMS fraud based on structured SMS data; An enhancement module is used to enhance the initial feature vector using the SMS fraud multimodal knowledge graph to obtain a knowledge-enhanced feature vector; A training module, used to input the knowledge-enhanced feature vector into multiple machine learning models for training to obtain an integrated SMS fraud recognition model; The analysis module is used to perform real-time analysis on newly received SMS messages based on the integrated SMS fraud identification model to obtain fraud risk prediction results.

[0035] Through the collaborative cooperation of the above-mentioned components, through multi-dimensional feature extraction and knowledge graph enhancement, the present invention can fully capture the semantics, structure and contextual information of text messages, and improve the richness and discrimination of feature representation. The construction method of multimodal knowledge graph is adopted to effectively integrate text and image information, expand the dimension of knowledge representation, and enhance the ability to understand complex fraud patterns. The use of multiple machine learning models for integrated learning overcomes the limitations of a single model and improves the robustness and generalization ability of fraud identification. The introduction of the Stacking model as a secondary learner realizes the adaptive fusion of prediction results of different models, and further optimizes the final fraud risk prediction results. Through real-time feature extraction and model prediction, the present invention can quickly analyze newly received text messages, meeting the real-time requirements in practical applications. The use of a risk threshold classification mechanism makes the fraud risk prediction results more explainable and operational, which is convenient for subsequent risk management and disposal.

[0036] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the SMS fraud identification method based on machine learning in the above-mentioned embodiments.

[0037] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the SMS fraud identification method based on machine learning.

[0038] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0039] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0040] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying SMS fraud based on machine learning, characterized in that: The method comprises: Preprocess the collected fraud and non-fraud SMS samples to obtain structured SMS data; Performing multi-dimensional feature extraction on the structured SMS data to obtain an initial feature vector; Constructing a multimodal knowledge graph of SMS fraud based on the structured SMS data; Using the SMS fraud multimodal knowledge graph to perform feature enhancement on the initial feature vector to obtain a knowledge enhanced feature vector; Inputting the knowledge-enhanced feature vector into multiple machine learning models for training to obtain an integrated SMS fraud identification model; Based on the integrated SMS fraud identification model, newly received SMS messages are analyzed in real time to obtain fraud risk prediction results.

2. The method for identifying SMS fraud based on machine learning according to claim 1, characterized in that: The collected fraudulent and non-fraudulent SMS samples are pre-processed to obtain structured SMS data, including: Special characters and punctuation marks are removed from the collected fraudulent and non-fraudulent SMS samples to obtain preliminary cleaned text data, and word segmentation is performed on the preliminary cleaned text data to obtain a text sequence after word segmentation; Performing stop word filtering on the segmented text sequence based on a predefined stop word list to obtain a keyword sequence, and performing part-of-speech analysis on the keyword sequence to obtain a word sequence with part-of-speech tags; Converting the word sequence with the part-of-speech tags into a unified UTF-8 encoding format to obtain text data with unified encoding, and performing length standardization processing on the text data with unified encoding to obtain a text sequence with fixed length; A word frequency matrix is ​​constructed based on the fixed-length text sequence to obtain a statistical feature representation of the text, and the statistical feature representation is combined with the fixed-length text sequence to obtain the structured SMS data.

3. The SMS fraud identification method based on machine learning according to claim 1 is characterized in that: The multi-dimensional feature extraction of the structured SMS data to obtain an initial feature vector includes: Performing word frequency-inverse document frequency calculation on the structured SMS data to obtain a TF-IDF feature matrix of the text, and performing vectorization processing on each word based on the structured SMS data to obtain a word embedding feature matrix; Encode the structured SMS data, extract context semantic representation, obtain semantic feature vector, build a topic model based on the structured SMS data, extract topic distribution of SMS, and obtain topic feature vector; Performing sending frequency and time distribution statistics on the sender information in the structured SMS data to obtain a behavior feature vector, extracting domain name reputation and URL length features based on the URL information in the structured SMS data to obtain a URL feature vector, and calculating the sentiment polarity and intensity of the structured SMS data to obtain a sentiment feature vector; The TF-IDF feature matrix, the word embedding feature matrix, the semantic feature vector, the topic feature vector, the behavior feature vector, the URL feature vector and the sentiment feature vector are concatenated and dimensionally reduced to obtain the initial feature vector.

4. The method for identifying SMS fraud based on machine learning according to claim 1, characterized in that: The method of constructing a multimodal knowledge graph of SMS fraud based on the structured SMS data includes: Performing semantic analysis on the structured SMS data, extracting key concepts and relationships, and constructing a knowledge graph skeleton including entity types, attributes, and relationship types based on a predefined fraud domain ontology model; Based on the knowledge graph skeleton, a named entity recognition algorithm and a relationship extraction algorithm are applied to the structured SMS data to identify entity and relationship descriptions in the SMS, and map them to corresponding entity types and relationship types to obtain an initial entity set and relationship set; Entities in the initial entity set are entity-linked with a pre-built knowledge base, the best matching entity is determined by calculating entity name similarity and context similarity, and relevant attribute information is extracted from the knowledge base to obtain an enriched entity set and relationship set; Based on the enriched entity set and relationship set, an initial knowledge graph is constructed, wherein the entities are used as nodes in the graph, the relationships are used as edges, and the original descriptions in the SMS text are used as attributes of the nodes and edges, thereby obtaining a unimodal knowledge graph containing text information; Scene recognition is performed on the image information contained in the structured SMS data to obtain image semantic tags and description text, and the image semantic tags and description text are associated with relevant entities in the unimodal knowledge graph, a connection is established between the text entity and the image information, and image features are used as new node attributes to obtain a multimodal knowledge graph for SMS fraud.

5. The method for identifying SMS fraud based on machine learning according to claim 1, characterized in that: The method of using the SMS fraud multimodal knowledge graph to perform feature enhancement on the initial feature vector to obtain a knowledge enhanced feature vector includes: Performing graph traversal on the SMS fraud multimodal knowledge graph, taking the entity corresponding to the initial feature vector as the starting point, performing multi-step random walks, and obtaining a subgraph structure containing related entities and relationships; Based on the subgraph structure containing related entities and relationships, embed the entities and relationships in the graph into a knowledge graph, map the entities and relationships into a low-dimensional vector space, and obtain entity embedding vectors and relationship embedding vectors; Aggregating the entity embedding vector and the relationship embedding vector to obtain an overall semantic representation vector of the subgraph, and performing information transfer and aggregation on the nodes in the subgraph structure to obtain a node representation vector that takes the graph structure into consideration; Based on the text and image information in the SMS fraud multimodal knowledge graph, a multimodal fusion network is constructed to fuse the features of different modalities to obtain a multimodal fusion feature vector; The initial feature vector is concatenated with the overall semantic representation vector of the subgraph, the node representation vector considering the graph structure, and the multimodal fusion feature vector to obtain an extended feature vector; Feature selection is performed on the extended feature vector to remove redundant and irrelevant features to obtain an optimized extended feature vector, and the optimized extended feature vector is input into a feature fusion network to perform adaptive weighted fusion on features from different sources to obtain the knowledge enhanced feature vector.

6. The method for identifying SMS fraud based on machine learning according to claim 1, characterized in that: The knowledge-enhanced feature vector is input into multiple machine learning models for training to obtain an integrated SMS fraud identification model, including: Input the knowledge-enhanced feature vector into a random forest model for training, wherein the random forest model includes 100 decision trees, each decision tree has a maximum depth of 10 and a minimum number of leaf node samples of 5, and obtains a random forest prediction result; Inputting the knowledge-enhanced feature vector into a support vector machine model for training, wherein the support vector machine model uses a radial basis function kernel and a penalty parameter C is set to 1.0, to obtain a support vector machine prediction result; Input the knowledge-enhanced feature vector into a gradient boosting decision tree model for training, wherein the gradient boosting decision tree model includes 500 trees, the learning rate is set to 0.1, the maximum depth is 5, and the prediction result of the gradient boosting decision tree is obtained; Based on the knowledge-enhanced feature vector, a long short-term memory network model is trained, wherein the long short-term memory network includes an embedding layer, two LSTM layers and a fully connected layer, each LSTM layer includes 128 LSTM units, and a long short-term memory network prediction result is obtained; Inputting the knowledge-enhanced feature vector into a convolutional neural network model for training, wherein the convolutional neural network comprises two convolutional layers, the two convolutional layers have 32 and 64 filters respectively, a kernel size of 3, two maximum pooling layers and two fully connected layers, and obtaining a convolutional neural network prediction result; Input the knowledge-enhanced feature vector into a Transformer model for training, wherein the Transformer model includes 6 encoder layers, each layer has 8 attention heads, and the hidden layer size is 512, and obtains the Transformer prediction result; Based on the knowledge-enhanced feature vector, a graph convolutional network model is trained, wherein the graph convolutional network comprises two graph convolutional layers, the two graph convolutional layers have 64 and 32 feature maps respectively, and a fully connected layer, and a graph convolutional network prediction result is obtained; Taking a weighted average of the random forest prediction result, the support vector machine prediction result, the gradient boosting decision tree prediction result, the long short-term memory network prediction result, the convolutional neural network prediction result, the Transformer prediction result and the graph convolutional network prediction result to obtain an integrated prediction result; A Stacking model is constructed based on the integrated prediction results, and logistic regression is used as a secondary learner to re-learn the prediction results of each model to obtain the integrated SMS fraud identification model.

7. The method for identifying SMS fraud based on machine learning according to claim 6, characterized in that: The method of performing real-time analysis on newly received SMS messages based on the integrated SMS fraud identification model to obtain fraud risk prediction results includes: Preprocessing and multi-dimensional feature extraction are performed on the newly received SMS to obtain a real-time feature vector, and the SMS fraud multimodal knowledge graph is used to enhance the features of the real-time feature vector to obtain a real-time enhanced feature vector; Input the real-time enhanced feature vector into the random forest model in the integrated SMS fraud identification model to obtain a first fraud probability prediction value, and input the real-time enhanced feature vector into the support vector machine model in the integrated SMS fraud identification model to obtain a second fraud probability prediction value; Based on the real-time enhanced feature vector, a gradient boosting decision tree model in the integrated SMS fraud identification model is used to perform prediction to obtain a third fraud probability prediction value, and the real-time enhanced feature vector is input into a long short-term memory network model in the integrated SMS fraud identification model to obtain a fourth fraud probability prediction value; Applying the convolutional neural network model and the Transformer model in the integrated SMS fraud identification model to the real-time enhanced feature vector, respectively obtaining a fifth fraud probability prediction value and a sixth fraud probability prediction value, and using the graph convolutional network model in the integrated SMS fraud identification model to make a prediction based on the real-time enhanced feature vector, to obtain a seventh fraud probability prediction value; Input the first fraud probability prediction value, the second fraud probability prediction value, the third fraud probability prediction value, the fourth fraud probability prediction value, the fifth fraud probability prediction value, the sixth fraud probability prediction value and the seventh fraud probability prediction value into the logistic regression layer for weighted fusion to obtain a target fraud probability prediction value; The target fraud probability prediction value is classified based on a preset risk threshold to obtain a fraud risk prediction result.

8. A device for identifying SMS fraud based on machine learning, characterized in that: Used to execute the SMS fraud identification method based on machine learning as described in any one of claims 1 to 7, the device comprises: A preprocessing module, used to preprocess the collected fraud and non-fraud SMS samples to obtain structured SMS data; An extraction module, used for performing multi-dimensional feature extraction on the structured SMS data to obtain an initial feature vector; A construction module, used to construct a multimodal knowledge graph of SMS fraud based on the structured SMS data; An enhancement module, used to perform feature enhancement on the initial feature vector using the SMS fraud multimodal knowledge graph to obtain a knowledge enhanced feature vector; A training module, used for inputting the knowledge-enhanced feature vector into multiple machine learning models for training to obtain an integrated SMS fraud identification model; The analysis module is used to perform real-time analysis on newly received text messages based on the integrated text message fraud identification model to obtain fraud risk prediction results.

9. A computer device, characterized in that: It includes a memory and a processor, the memory stores a computer program that can be run on the processor, and is characterized in that when the processor executes the computer program, it implements the SMS fraud identification method based on machine learning as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the processor is enabled to execute the SMS fraud identification method based on machine learning as described in any one of claims 1 to 7.

Images