Message processing method and device, electronic equipment and program product

Abstract

The invention provides a message processing method and device, electronic equipment and a program product, which are applied to a monitoring node, and the monitoring node is deployed on a message channel between a message sending end and a message receiving end. The method comprises the following steps: receiving a target message sent by a message sending end to a message receiving end; performing time sequence coding on the target message, the message sending end and / or the message receiving end based on a large language model, and performing risk identification based on an obtained time sequence coding result to obtain a corresponding risk identification result; wherein the related information comprises at least one of a sending rule and a content rule of the historical message. According to the invention, risk identification can be carried out on violation information so as to construct a safety monitoring mechanism.

Description

Technical Field

[0001] The present application relates to the field of risk control, and in particular to a message processing method, device, electronic equipment and program product. Background Art

[0002] 5G messages are an upgrade of traditional SMS services. They can send multiple types of content such as text, pictures, audio and video without installing an APP, bringing users a new experience of "message as a service".

[0003] With the rapid development of 5G messaging technology, data transmission capacity and speed have been greatly improved, but at the same time, it has brought greater risks in content security management. Black industries may take advantage of the high-speed transmission characteristics to quickly steal or tamper with information, or spread illegal information through 5G messaging by changing descriptions or using code words.

[0004] To this end, there is an urgent need for a security monitoring mechanism that can identify and process illegal information. Summary of the invention

[0005] The purpose of this application is to provide a message processing method, device, electronic device and program product that can identify risks of illegal information to build a security monitoring mechanism.

[0006] In order to achieve the above purpose, the embodiment of the present application is implemented as follows: In a first aspect, a message processing method is provided, which is applied to a monitoring node, wherein the monitoring node is deployed on a message channel between a message sending end and a message receiving end, and the method comprises: Receiving a target message sent by the message sending end to the message receiving end; Based on the large language model, time-series coding is performed on the relevant information of the target message, the message sender and / or the message receiver, and risk identification is performed based on the time-series coding result to obtain a corresponding risk identification result; wherein the relevant information includes at least one of the sending regularity and content regularity of historical messages.

[0007] In a second aspect, a message processing device is provided, which is applied to a monitoring node, wherein the monitoring node is deployed on a message channel between a message sending end and a message receiving end, and includes: A receiving module, used for receiving a target message sent by the message sending end to the message receiving end; An identification module is used to perform time-series coding on the relevant information of the target message, the message sender and / or the message receiver based on a large language model, and perform risk identification based on the time-series coding results to obtain corresponding risk identification results; wherein the relevant information includes at least one of the sending rules and content rules of historical messages.

[0008] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor; and a memory configured to store computer-executable instructions, wherein the computer-executable instructions, when executed, cause the processor to execute the method described in the first aspect.

[0009] According to a fourth aspect, a computer program product is provided, the computer program product comprising a computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute the method described in the first aspect.

[0010] The embodiment of the present application proposes a message processing scheme, which is applied to a monitoring node on a message channel between a message sending end and a message receiving end. When the monitoring node receives a target message sent by the message sending end, the target message and related information of the message sending end and / or the message receiving end, such as the sending frequency and content regularity of historical messages, are time-coded based on a large language model, and risk identification is performed based on the time-coding result, which is equivalent to comprehensively assessing the risk based on the currently intercepted target message and the historical message sending regularity and / or historical message content regularity of both the message sending and receiving ends. In related applications, a decision can be made based on the risk identification result whether to forward the target message to the message receiving end or to directly intercept the target message, thereby realizing a security protection mechanism for illegal information. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0011] Figure 1 A schematic diagram of the application architecture of the message processing solution of an embodiment of the present application.

[0012] Figure 2 A flowchart of a message processing method according to an embodiment of the present application.

[0013] Figure 3 A schematic diagram of the prevention effect of the message processing method of an embodiment of the present application on illegal information.

[0014] Figure 4 A schematic diagram of the structure of a message processing device according to an embodiment of the present application.

[0015] Figure 5 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0017] The present application proposes a message processing solution, which can first intercept the target message sent by the message sending end during the interaction between the message sending end and the message receiving end, and based on the large language model, time-code the target message and related information of the message sending end and / or the message receiving end, such as: the sending frequency and content regularity of historical messages, and identify risks based on the time-coding results, which is equivalent to comprehensively assessing risks based on the currently intercepted target message and the historical message sending regularity and / or historical message content regularity of both the message sending and receiving ends; in related applications, it can be decided whether to forward the target message to the message receiving end or to directly intercept the target message based on the obtained risk identification results, thereby realizing a security protection mechanism for illegal information. in, Figure 1 The application framework diagram of the message processing solution of the present application is shown in FIG. The message processing solution of the present application is specifically implemented by a monitoring node, which is deployed on a message channel between a message sending end and a message receiving end.

[0018] against Figure 1 As shown in the application framework schematic diagram, an embodiment of the present application provides a message processing method applied to a monitoring node. Figure 2 It is a flowchart of the message processing method, which includes the following steps: S102, obtaining a target message sent by a message sending end, where the target message has not yet been received by a message receiving end.

[0019] This embodiment can monitor the message sending port of the message sending end, so as to intercept the target message when the message sending end is monitored to send the target message. It should be understood that the intercepted target message has not been sent to the message receiving end.

[0020] Here, an application scenario in the field of communications is used as an example. If the target message is a rich media service message provided by a 5G messaging platform, the 5G messaging platform can be used as the message sending end described in this embodiment, and correspondingly, the 5G messaging user terminal can be used as the message receiving end described in this embodiment. In addition, it should be noted that message interaction can be bidirectional. If the target message is a message sent by a 5G messaging user terminal to a 5G messaging platform, the 5G messaging user terminal is used as the message sending end described in this embodiment, and the 5G messaging platform is used as the message receiving end described in this embodiment.

[0021] S104, based on the large language model, time-series coding is performed on the relevant information of the target message, the message sender and / or the message receiver to obtain a time-series coding result; and, based on the time-series coding result, risk identification is performed to obtain a corresponding risk identification result; wherein the relevant information includes at least one of the sending regularity and content regularity of historical messages.

[0022] In this embodiment, the sending rule may be but is not limited to: the sending frequency and / or sending time of the historical message; the content rule may be but is not limited to: the content link and / or content type of the historical message.

[0023] Large Language Model (LLM) refers to a collection of deep learning models with multiple functions that can generate or understand the semantics of natural language text, so it can handle a variety of natural language tasks, such as text classification, question answering, dialogue, etc. In addition, in the case of understanding semantics, the setting of prompts can also guide the large language model to achieve more advanced functions.

[0024] For example, in this embodiment, a large language model is needed for risk identification, and the prompt words may be: “Assuming you are a risk control expert, please make a risk assessment of the target information based on the following information: The target information is: ...; The relevant information of the message sender is: ...; The relevant information of the receiving device is: ……;”.

[0025] In practical applications, the relevant information of the message sending end and / or the message receiving end of this embodiment may also include: user portrait (i.e., user portrait). Through these relevant information, the accuracy of identifying the risk of the target information can be further improved. For example, through the historical messages of the message sending end, it is found that it frequently sends website links carrying violations during the target period. If the target message is also sent during the target period, it can be judged that the sending intention of the target message has a high risk, which can be used as a basis for judging risk identification.

[0026] Among them, under the guidance of the prompt word, the large language model performs risk identification on the target message through deep learning training. That is, in this embodiment, the large language model can be trained based on the sample information and the risk label (true value) corresponding to the sample information. The training principle is: after the sample information is input into the large language model, the large language model attempts to provide the risk identification result corresponding to the sample information; then, the loss (such as cross entropy loss) between the risk identification result provided by the large language model and the risk label is calculated, and the relevant parameters of the large language model are adjusted for the purpose of reducing the loss. In this way, the large language model is continuously iterated, so that the risk identification result provided by the large language model for the sample information can be close to the same as the risk label (true value), so as to have the risk identification ability. It should be noted that the setting of the above risk label depends on what kind of risk identification result is expected. For example, the risk identification in this embodiment refers to the need to identify the risk level corresponding to the target message, and the risk label corresponding to the sample information is specifically a risk level label, which is used to indicate the risk level corresponding to the sample information.

[0027] The above is an introduction to training the risk identification capability of a large language model. In the specific process of risk identification, the large language model mainly involves encoding steps and classification steps.

[0028] The encoding step refers to encoding (mapping) the relevant information of the target message, the message sender and / or the message receiver into the same space and representing it with a feature vector to ensure standardization and machine recognition. The classification step is to calculate the confidence of different types of risk identification results based on the encoding results (such as calculating the confidence of different risk levels), and use the risk identification result with the highest confidence as the final output.

[0029] Specifically, in the encoding step, this embodiment can first perform time-series encoding on the target message, the message sender and / or the message receiver based on the large language model to obtain a time-series encoding result represented by a time domain sequence; then, based on the large language model, the Transformer self-attention mechanism is used to positionally encode the sequence encoding result, and the position encoding result can reflect the characteristics of the time regularity and the sending frequency regularity, so that in the classification step, the time regularity and the sending frequency regularity are used as the weights of the risk identification results, and confidence calculations are performed based on this. It should be noted that the position encoding based on the Transformer self-attention mechanism can retain the contextual associations in the time-series encoding results, which can help the large language model better understand the semantics of the target message.

[0030] In practical applications, the target message may contain different types of message content, such as text, pictures, audio, and video; correspondingly, the large language model of this embodiment can select appropriate encoding methods for different types of message content to perform semantic-based position encoding. For example: when the target message contains text information, the large language model can perform semantic-based position encoding on the text information or keywords in the text information based on its internal language representation model; when the target message contains multimedia information, the large language model can perform semantic-based position encoding on the multimedia information based on its internal image recognition model and audio recognition model.

[0031] In addition, for the scenario where the violation information is sent in multiple messages, this embodiment also proposes an information restoration mechanism. That is, the monitoring node caches the historical messages of the message sender and / or the message receiver. After intercepting the target message, the historical messages of the message sender and / or the message receiver can be refined based on the large language model to obtain context information (including continuity information related to the target message), and the context information is added to the target message to try to restore the complete information.

[0032] On the basis of the above, in order to improve the accuracy of information restoration, this embodiment can also first identify the intent of the target message based on the large language model, and then extract context information that matches the intent identification result from the historical messages of the message sender and / or the message receiver. In addition, considering that multiple messages are usually sent in a centralized manner, this embodiment can also deploy a preset time threshold for indicating timeliness. After intercepting the target message, the context information is extracted from the historical messages whose time interval with the target message does not exceed the preset time threshold (such as 10 minutes) based on the large language model.

[0033] The above are the steps of risk identification for the target message in the method of this embodiment. Among them, the risk identification result can be used to decide whether to take risk treatment measures for the target message. Correspondingly, the method of this embodiment also includes the following steps: S106, executing a target risk handling measure that matches the risk identification result on the target message, where the target risk handling measure is used to forward the target message to a message receiving end or to intercept the target message.

[0034] In this embodiment, the risk identification result includes a target risk level corresponding to the target message; correspondingly, this step can execute a target risk handling measure that matches the target message on the target message based on a mapping relationship between a preset risk level and a risk handling measure.

[0035] As an example, risk levels and corresponding risk treatment measures may include: The first risk level, the corresponding risk handling measures are used to add security prompt information in the target message.

[0036] The second risk level, the corresponding risk handling measures are used to add security prompt information to the target message, and set a cancelable mask layer for the area of ​​the original information of the target message and then forward it to the message receiving end. The mask layer is used to block the target message from displaying the original information.

[0037] The third risk level, the corresponding risk handling measures are used to add security prompt information to the target message, and forward the original information of the target message to the message receiving end as the link display content of the security prompt information.

[0038] The fourth risk level, the corresponding risk handling measures are used to intercept the target message to refuse to forward it to the message recipient.

[0039] As an example, refer to Figure 3 As shown, assuming that the target message is a hyperlink to a 5G rich media service, the risk handling measures for the first risk level on the receiving end can be as follows: Figure 3 As shown in (a), the security prompt message "This message has XX risk, please click with caution!" is displayed below the hyperlink button; the risk handling measures for the second risk level can be as follows: Figure 3 As shown in (b), the hyperlink interface of the 5G rich media service is shielded by a mask layer, and a security prompt message "This message has XX risk" is displayed on the mask layer, as well as a "Still view" option for canceling the mask layer; the risk handling measures for the third risk level can be as follows: Figure 3 (c) includes: providing a security reminder message of "An XX risk message has been filtered, still viewing", and using the hyperlink of the 5G rich media service as the link display content of "still viewing"; the risk handling measures for the fourth risk level can be as follows: Figure 3 As shown in (d), the receiving end cannot receive the target message.

[0040] For the above functions, refer to Figure 1 As shown, the functions configured by the monitoring node of this embodiment include data collection, data processing, model training, model application, real-time detection and real-time response.

[0041] Here, the sending end is a 5G message platform and the receiving end is a 5G message user terminal as an example.

[0042] The data collection function is mainly used to: obtain and record relevant information of the sender and / or receiver through the connection with the 5G message platform and the 5G message user terminal through a dedicated data interface, such as: user portrait, historical messages, historical message sending frequency, historical message time, links contained in historical messages, content type of historical messages, etc. This information is used to identify risks in combination with the target message.

[0043] The data processing function is mainly used to: perform invalid filtering and structured preprocessing on the relevant information obtained by the data collection function. In addition, embedding encoding is performed on the preprocessed relevant information to convert the relevant information into an embedding vector that can be directly used by the large language model.

[0044] The model training function is mainly used to train the risk identification capability of the large language model based on sample information (with risk labels). The sample information can come from the information intercepted from the sender and related information, which has been converted into embedded vectors for representation by the data processing function.

[0045] The real-time detection function is mainly used to monitor the sending port of the sending device to intercept the target message sent by the sending device, so as to call the large language model to complete risk identification.

[0046] The model application function is mainly used to provide risk identification support for large language models for real-time detection. It can be regarded as an intelligent body of the large language model, providing relevant configurations such as prompt words and model parameters.

[0047] The real-time response function is mainly used to: take risk treatment measures that match the risk identification results for the target message, so as to complete the corresponding rendering display at the receiving end. For specific rendering display effects, please refer to Figure 3 It should be noted that Figure 3 The rendering effect shown can be configured on the target message side of the monitoring node, or on the receiving end. If the configuration is completed on the receiving end, the monitoring node only needs to mark the corresponding risk level of the target message, that is, the action of "marking the risk level" is the risk handling measure; correspondingly, when the receiving end receives the target message, it can render and display the target message according to the marked risk level.

[0048] In summary, the security prevention mechanism constructed by the monitoring node of this embodiment based on the large language model has the following characteristics: 1. High degree of automation: The introduction of large models significantly improves the speed and efficiency of real-time monitoring and analysis of 5G message content, while reducing the need for manual intervention and achieving adaptive security management; 2. Strong flexibility: Using deep learning technology, it can identify complex patterns and semantic relationships, and detect abnormal or illegal message content without clear rules. In addition, the large language model supports monitoring of multiple types of message content, such as text, pictures, audio and video; 3. High adaptability: The large language model can be continuously iterated in the real environment, which improves the ability to identify and prevent new types of illegal messages and ensures that the security prevention mechanism remains forward-looking and timely.

[0049] In addition, corresponding to Figure 1 The method shown, another embodiment of this embodiment also provides a message processing device. Figure 4 4 is a schematic diagram of the structure of the message processing device 400, including: The receiving module 410 is used to receive a target message sent by the message sending end to the message receiving end.

[0050] The identification module 420 is used to perform time-series coding on the relevant information of the target message, the message sender and / or the message receiver based on the large language model, and perform risk identification based on the time-series coding results to obtain corresponding risk identification results; wherein the relevant information includes at least one of the sending rules and content rules of historical messages.

[0051] The above is an introduction to the modules of the device of this embodiment for risk identification of the target message. Among them, the risk identification result can be used to decide whether to take risk treatment measures for the target message. Correspondingly, the device of this embodiment also includes: An execution module is used to execute a target risk handling measure that matches the risk identification result on the target message, and the target risk handling measure is used to forward the target message to a message receiving end or intercept the target message.

[0052] The device of this embodiment is applied to a monitoring node on a message channel between a message sending end and a message receiving end. When the monitoring node receives a target message sent by the message sending end, the target message and related information of the message sending end and / or the message receiving end, such as the sending frequency and content regularity of historical messages, are time-coded based on a large language model, and risk identification is performed based on the time-coding result, which is equivalent to comprehensively assessing the risk based on the currently intercepted target message and the historical message sending regularity and / or historical message content regularity of both the message sending and receiving ends. In related applications, a decision can be made based on the risk identification result whether to forward the target message to the message receiving end or to directly intercept the target message, thereby realizing a security protection mechanism for illegal information.

[0053] Optionally, before performing risk identification based on the large language model and the relevant information of the target message, the message sender and / or the message receiver, the identification module 420 is also used to: extract historical messages of the message sender and / or the message receiver based on the large language model to obtain context information, and add the context information to the target message, wherein the context information includes continuity information related to the target message.

[0054] Optionally, the identification module 420 extracts historical messages of the message sender and / or the message receiver based on a large language model to obtain context information, including: performing intent recognition on the target message based on a large language model, and extracting context information that matches the intent recognition result from the historical messages of the message sender and / or the message receiver.

[0055] Optionally, the time interval between the historical messages of the message sending end and / or the message receiving end and the target message does not exceed a preset time threshold.

[0056] Optionally, the identification module 420 performs time series encoding on the target message, the message sender and / or the message receiver based on the large language model, and performs risk identification based on the time series encoding result to obtain a corresponding risk identification result, including: performing time series encoding on the target message, the message sender and / or the message receiver based on the large language model, and performing position encoding on the time series encoding result using the Transformer self-attention mechanism to obtain a corresponding risk identification result.

[0057] Optionally, the risk identification result indicates a target risk level corresponding to the target message; the execution module executes a risk handling measure matching the risk identification result on the target message, including: executing a target risk handling measure matching the target message on the target message based on a mapping relationship between a preset risk level and a risk handling measure; Optionally, the risk level includes a first risk level, and a risk handling measure corresponding to the first risk level is used to add security prompt information to the target message.

[0058] Optionally, the risk level includes a second risk level, and the risk handling measures corresponding to the second risk level are used to add security prompt information to the target message, and set a revocable mask layer for the area of ​​the original information of the target message and then forward it to the message receiving end, and the mask layer is used to block the target message from displaying the original information.

[0059] Optionally, the risk level includes a third risk level, and the risk handling measures corresponding to the third risk level are used to add security prompt information to the target message, and forward the original information of the target message to the message receiving end as the link display content of the security prompt information.

[0060] Optionally, the risk level includes a fourth risk level, and the risk handling measure corresponding to the fourth risk level is used to intercept the target message to refuse to forward it to the message receiving end.

[0061] Optionally, the large language model is trained based on sample information and a risk level label corresponding to the sample information, and the risk level label is used to indicate the risk level corresponding to the sample information.

[0062] Optionally, the sending rule includes: sending frequency and / or sending time; the content rule includes: content link and / or content type.

[0063] Optionally, the relevant information of the message sending end and / or the message receiving end also includes: a user portrait.

[0064] Optionally, the message sending end includes one of a 5G message platform and a 5G message user terminal, and the message receiving end includes the other of the 5G message platform and the 5G message user terminal.

[0065] Optionally, the receiving module 410 receives the target message sent by the message sending end to the message receiving end, including: monitoring the message sending port of the message sending end, so as to obtain the target message when monitoring the message sending end to send the target message. It should be noted that the message processing device of this embodiment can be used as Figure 1 The execution subject of the method shown can thus realize Figure 1 The steps and functions in the method shown.

[0066] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0067] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0068] The memory is used to store the computer program. Specifically, the computer program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides the computer program to the processor.

[0069] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming the above-mentioned Figure 4 Correspondingly, the processor executes the program stored in the memory and is specifically used to perform the following operations: A target message sent by a message sending end is obtained, where the target message has not yet been received by a message receiving end.

[0070] Based on the large language model, relevant information of the target message, the message sender and / or the message receiver is time-coded to obtain a time coding result; and based on the time coding result, risk identification is performed to obtain a corresponding risk identification result; wherein the relevant information includes at least one of the sending regularity and content regularity of historical messages.

[0071] The electronic device of this embodiment is applied to a monitoring node on a message channel between a message sending end and a message receiving end. When the monitoring node receives a target message sent by the message sending end, the target message and related information of the message sending end and / or the message receiving end, such as the sending frequency and content regularity of historical messages, are time-coded based on a large language model, and risk identification is performed based on the time-coding result, which is equivalent to comprehensively assessing the risk based on the currently intercepted target message and the historical message sending regularity and / or content regularity of the message sending and receiving ends. In related applications, a decision can be made based on the risk identification result whether to forward the target message to the message receiving end or to directly intercept the target message, thereby realizing a security protection mechanism for illegal information.

[0072] The above is as in this manual Figure 1The illegal webpage judgment method disclosed in the illustrated embodiment can be applied to a processor and implemented by the processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in a decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0073] Of course, in addition to software implementation, the electronic device of this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0074] In addition, an embodiment of the present application also proposes a computer-readable storage medium, which stores one or more computer programs, and the one or more computer programs include instructions.

[0075] When the above instructions are executed by a portable electronic device including multiple application programs, the portable electronic device can execute Figure 1 The steps in the method shown include: A target message sent by a message sending end is obtained, where the target message has not yet been received by a message receiving end.

[0076] Based on the large language model, relevant information of the target message, the message sender and / or the message receiver is time-coded to obtain a time coding result; and based on the time coding result, risk identification is performed to obtain a corresponding risk identification result; wherein the relevant information includes at least one of the sending regularity and content regularity of historical messages.

[0077] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0079] The above are only embodiments of this specification and are not intended to limit this specification. For those skilled in the art, this specification may be subject to various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims of this specification. In addition, all other embodiments obtained by ordinary technicians in this field without creative work shall fall within the scope of protection of this document.

Claims

1. A message processing method, applied to a monitoring node, wherein the monitoring node is deployed on a message channel between a message sending end and a message receiving end, characterized in that: The method comprises: Receiving a target message sent by the message sending end to the message receiving end; Based on the large language model, time-series coding is performed on the relevant information of the target message, the message sender and / or the message receiver to obtain a time-series coding result; and based on the time-series coding result, risk identification is performed to obtain a corresponding risk identification result; wherein the relevant information includes at least one of the sending regularity and content regularity of historical messages.

2. The method according to claim 1, characterized in that Before performing risk identification based on the large language model and the relevant information of the target message, the message sender and / or the message receiver, the method further includes: Based on the large language model, historical messages of the message sender and / or the message receiver are refined to obtain context information, and the context information is added to the target message, wherein the context information includes continuity information related to the target message.

3. The method according to claim 2, characterized in that The historical messages of the message sending end and / or the message receiving end are refined based on the large language model to obtain context information, including: The target message is subjected to intent recognition based on a large language model, and context information matching the intent recognition result is extracted from historical messages of the message sending end and / or the message receiving end.

4. The method according to claim 2, characterized in that: The time interval between the historical messages of the message sending end and / or the message receiving end and the target message does not exceed a preset time threshold.

5. The method according to claim 1, characterized in that Based on the large language model, the relevant information of the target message, the message sender and / or the message receiver is time-series encoded, and risk identification is performed based on the time-series encoding result to obtain a corresponding risk identification result, including: Based on the large language model, the relevant information of the target message, the message sender and / or the message receiver is temporally encoded, and the temporal encoding result is positionally encoded using the Transformer self-attention mechanism to obtain the corresponding risk identification result.

6. The method according to any one of claims 1 to 5, characterized in that: After obtaining the risk identification result, the method further includes: A target risk handling measure matching the risk identification result is executed on the target message, wherein the target risk handling measure is used to forward the target message to a message receiving end or to intercept the target message.

7. The method according to claim 6, characterized in that The risk identification result indicates a target risk level corresponding to the target message; Executing a risk handling measure matching the risk identification result on the target message, including: Based on a preset mapping relationship between risk levels and risk handling measures, a target risk handling measure matching the target message is executed on the target message.

8. The method according to claim 7, characterized in that The risk level includes a first risk level, and the risk handling measure corresponding to the first risk level is used to add security prompt information to the target message.

9. The method according to claim 7, characterized in that: The risk level includes a second risk level, and the risk handling measures corresponding to the second risk level are used to add security prompt information in the target message, and set a revocable mask layer for the area of ​​the original information of the target message and then forward it to the message receiving end, and the mask layer is used to block the target message from displaying the original information.

10. The method according to claim 7, characterized in that The risk level includes a third risk level, and the risk handling measures corresponding to the third risk level are used to add security prompt information to the target message, and forward the original information of the target message to the message receiving end as the link display content of the security prompt information.

11. The method according to claim 7, characterized in that The risk level includes a fourth risk level, and the risk handling measure corresponding to the fourth risk level is used to intercept the target message to refuse to forward it to the message receiving end.

12. The method according to claim 7, characterized in that The large language model is trained based on sample information and risk level labels corresponding to the sample information, and the risk level labels are used to indicate the risk level corresponding to the sample information.

13. The method according to any one of claims 1 to 5, characterized in that: The sending rule includes: sending frequency and / or sending time; the content rule includes: content link and / or content type.

14. The method according to any one of claims 1 to 5, characterized in that: The message sending end includes one of a 5G message platform and a 5G message user terminal, and the message receiving end includes the other of the 5G message platform and the 5G message user terminal.

15. The method according to any one of claims 1 to 5, characterized in that: Receiving a target message sent by the message sending end to the message receiving end, comprising: Message monitoring is performed on a message sending port of a message sending end, so as to obtain the target message when the message sending end is monitored to send the target message.

16. A message processing device, applied to a monitoring node, wherein the monitoring node is deployed on a message channel between a message sending end and a message receiving end, characterized in that: The device comprises: A receiving module, used for receiving a target message sent by the message sending end to the message receiving end; An identification module is used to perform time-series coding on the target message, the message sender and / or the message receiver's related information based on a large language model to obtain a time-series coding result; and to perform risk identification based on the time-series coding result to obtain a corresponding risk identification result; wherein the related information includes at least one of the sending regularity and content regularity of historical messages.

17. An electronic device comprising: processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to perform the method according to any one of claims 1 to 15.

18. A computer program product, comprising a computer-readable storage medium storing a computer program, characterized in that: The computer program is operable to cause a computer to perform the method according to any one of claims 1 to 15.

Images