Message processing method and apparatus, electronic device, and program product

Abstract

The application provides a message processing method and device, electronic equipment and program product, which are applied to a monitoring node. The monitoring node is deployed on a message channel between a message sending end and a message receiving end. The method comprises the following steps: receiving a target message sent by the message sending end to the message receiving end. The relevant information of the target message, the message sending end and / or the message receiving end is time series coded based on a large language model, and risk identification is performed based on the obtained time series coding result to obtain a corresponding risk identification result. The relevant information includes at least one of the sending rule and the content rule of historical messages. The application can identify the risk of illegal information to construct a security monitoring mechanism.

Description

Technical Field

[0001] This application relates to the field of risk control, and in particular to a message processing method, apparatus, electronic device, and program product. Background Technology

[0002] 5G messaging is an upgrade to traditional SMS service, enabling the sending of various types of content such as text, images, audio, and video without the need to install an app, bringing users a brand-new "messaging as a service" experience.

[0003] With the rapid development of 5G messaging technology, data transmission capacity and speed have increased significantly, but this has also brought greater risks to content security control. Cybercriminals may exploit the high-speed transmission characteristics to quickly steal or tamper with information, or spread illegal information via 5G messaging by changing descriptions or using code words.

[0004] Therefore, there is an urgent need for a security monitoring mechanism that can identify and process illegal information. Summary of the Invention

[0005] The purpose of this application is to provide a message processing method, apparatus, electronic device, and program product that can identify risks of illegal information in order to build a security monitoring mechanism.

[0006] To achieve the above objectives, the embodiments of this application are implemented as follows:

[0007] Firstly, a message processing method is provided, applied to a monitoring node, wherein the monitoring node is deployed on a message channel between a message sender and a message receiver, the method comprising:

[0008] Receive the target message sent by the message sender to the message receiver;

[0009] The target message, the message sender and / or the message receiver are time-series encoded based on a large language model, and risk identification is performed based on the time-series encoding results to obtain the corresponding risk identification results; wherein, the relevant information includes at least one of the sending pattern and content pattern of historical messages.

[0010] Secondly, a message processing device is provided for use in a monitoring node, wherein the monitoring node is deployed on a message channel between a message sender and a message receiver, comprising:

[0011] The receiving module is used to receive the target message sent by the message sender to the message receiver;

[0012] The identification module is used to perform time-series encoding on the target message, the message sender and / or the message receiver based on a large language model, and to perform risk identification based on the time-series encoding results to obtain the corresponding risk identification results; wherein, the relevant information includes at least one of the sending patterns and content patterns of historical messages.

[0013] Thirdly, embodiments of this application provide an electronic device, including: a processor; and a memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the method described in the first aspect.

[0014] Fourthly, a computer program product is provided, the computer program product including a computer-readable storage medium storing a computer program operable to cause a computer to perform the method described in the first aspect.

[0015] This application proposes a message processing scheme applied to a monitoring node on a message channel between a message sender and a message receiver. When the monitoring node receives a target message sent by the message sender, it performs time-series encoding on the target message and related information of the message sender and / or message receiver, such as the sending frequency and content patterns of historical messages, based on a large language model. Risk identification is then performed based on the time-series encoding results. Essentially, it comprehensively assesses the risk based on the currently intercepted target message, combined with the historical message sending patterns and / or historical message content patterns of both ends of the message transmission. In relevant applications, the risk identification results can be used to decide whether to forward the target message to the message receiver or directly intercept the target message, thereby achieving a security protection mechanism against illegal information. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the application architecture of the message processing scheme in an embodiment of this application.

[0018] Figure 2 This is a flowchart illustrating the message processing method according to an embodiment of this application.

[0019] Figure 3 This is a schematic diagram illustrating the effect of the message processing method in this application on preventing illegal information.

[0020] Figure 4 This is a schematic diagram of the message processing device according to an embodiment of this application.

[0021] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0023] This application proposes a message processing scheme that, during the interaction between the message sender and the message receiver, first intercepts the target message sent by the message sender, and then performs time-series encoding on the target message, as well as relevant information from the message sender and / or the message receiver, such as the sending frequency and content patterns of historical messages, based on a large language model. Risk identification is then performed based on the time-series encoding results. Essentially, it comprehensively assesses the risk based on the currently intercepted target message, combined with the historical message sending patterns and / or historical message content patterns of both the sender and receiver. In relevant applications, the risk identification results can be used to decide whether to forward the target message to the message receiver or directly intercept the target message, thereby achieving a security protection mechanism against illegal information.

[0024] in, Figure 1 This diagram illustrates the application framework of the message processing solution presented in this application. Specifically, the message processing solution utilizes a monitoring node as the execution entity, which is deployed on the message channel between the message sender and the message receiver.

[0025] against Figure 1 The illustrated application framework diagram shows an embodiment of this application that provides a message processing method applied to a monitoring node. Figure 2 This is a flowchart illustrating the message processing method, which includes the following steps:

[0026] S102, retrieve the target message sent by the message sender, which has not yet been received by the message receiver.

[0027] This embodiment can monitor the message sending port of the message sender to intercept the target message when it is detected that the message sender is sending the target message. It should be understood that the intercepted target message has not yet been sent to the message receiver.

[0028] This example uses a communication application scenario. If the target message is a rich media service message provided by a 5G messaging platform, then the 5G messaging platform can act as the message sender in this embodiment, and correspondingly, the 5G messaging user terminal can act as the message receiver in this embodiment. Furthermore, it should be noted that message interaction can be bidirectional. If the target message is a message sent from the 5G messaging user terminal to the 5G messaging platform, then the 5G messaging user terminal acts as the message sender in this embodiment, and the 5G messaging platform acts as the message receiver in this embodiment.

[0029] S104, perform time-series encoding on the target message, the message sender and / or the message receiver based on the large language model to obtain the time-series encoding result; and, perform risk identification based on the time-series encoding result to obtain the corresponding risk identification result; wherein, the relevant information includes at least one of the historical message sending pattern and content pattern.

[0030] In this embodiment, the sending pattern may be, but is not limited to, the sending frequency and / or sending time of historical messages; the content pattern may be, but is not limited to, the content links and / or content types of historical messages.

[0031] A Large Language Model (LLM) is a collection of deep learning models with multiple functions that can generate or understand the semantics of natural language text, thus enabling it to handle various natural language tasks such as text classification, question answering, and dialogue. Furthermore, given semantic understanding, the LLM can be guided to achieve even more advanced functions through the setting of prompts.

[0032] For example, in this embodiment, a large language model is needed for risk identification, so the prompt words could be:

[0033] "Assuming you are a risk control expert, please assess the risk of the target information based on the following information:"

[0034] The target information is: ...;

[0035] The relevant information for the message sender is: ...;

[0036] The relevant information for the receiving device is: ...;".

[0037] In practical applications, the relevant information of the message sender and / or message receiver in this embodiment may further include: user profile (i.e., user profiling). This relevant information can further improve the accuracy of risk identification for target information. For example, if historical messages from the message sender show that it frequently sends links to illegal websites during the target time period, then when the target message is also sent during the target time period, it can be determined that the sending intent of the target message poses a high risk, and this can be used as a basis for risk identification.

[0038] In this embodiment, guided by prompts, the large language model performs risk identification on the target message through deep learning training. Specifically, this embodiment trains the large language model based on sample information and its corresponding risk labels (truth values). The training principle is as follows: after inputting sample information into the large language model, the model attempts to provide a risk identification result corresponding to the sample information; then, the loss between the risk identification result provided by the large language model and the risk label (such as cross-entropy loss) is calculated, and the relevant parameters of the large language model are adjusted to reduce this loss. By continuously iterating the large language model in this way, the risk identification result provided by the large language model for the sample information can be made closer to the consistency with the risk label (truth value), thus achieving risk identification capability. It should be noted that the setting of the aforementioned risk label depends on the desired risk identification result. For example, in this embodiment, risk identification refers to identifying the risk level corresponding to the target message; therefore, the risk label corresponding to the sample information is specifically a risk level label, used to indicate the risk level corresponding to the sample information.

[0039] The above is an introduction to training the risk identification capabilities of a large language model. In the specific process of risk identification, the large language model mainly involves encoding and classification steps.

[0040] The encoding step involves encoding (mapping) the relevant information of the target message, the message sender, and / or the message receiver into the same space, representing it with feature vectors to ensure standardization and machine recognition. The classification step calculates the confidence level of different types of risk identification results based on the encoding results (e.g., calculating the confidence level of different risk levels), and takes the risk identification result with the highest confidence level as the final output.

[0041] Specifically, in the encoding step, this embodiment can first perform temporal encoding on the relevant information of the target message, the message sender, and / or the message receiver based on a large language model, obtaining a temporal encoding result represented by a time-domain sequence. Then, based on the large language model, positional encoding is performed on the temporal encoding result using a Transformer self-attention mechanism. This positional encoding result reflects the characteristics of time patterns and transmission frequency patterns. Therefore, in the classification step, the weights of time patterns and transmission frequency patterns on the risk identification result are used, and confidence is calculated based on these weights. It should be noted that positional encoding based on the Transformer self-attention mechanism can preserve the contextual relationships in the temporal encoding result, helping the large language model better understand the semantics of the target message.

[0042] In practical applications, target messages can contain different types of message content, such as text, images, audio, and video. Correspondingly, the large language model in this embodiment can select an appropriate encoding method for semantic-based positional encoding for different types of message content. For example, when the target message contains text information, the large language model can perform semantic-based positional encoding on the text information or keywords within the text information based on its internal language representation model; when the target message contains multimedia information, the large language model can perform semantic-based positional encoding on the multimedia information based on its internal image recognition model and audio recognition model.

[0043] Furthermore, for scenarios where illegal information is sent in multiple messages, this embodiment also proposes an information restoration mechanism. Specifically, the monitoring node caches historical messages from the message sender and / or message receiver. After intercepting the target message, it can extract contextual information (including continuity information related to the target message) from the historical messages of the message sender and / or message receiver based on a large language model. This contextual information is then added to the target message to attempt to restore the complete information.

[0044] Building upon the above, to improve the accuracy of information reconstruction, this embodiment can first perform intent recognition on the target message based on a large language model, and then extract contextual information matching the intent recognition result from historical messages from the message sender and / or the message receiver. Furthermore, considering that multiple messages are usually sent in a concentrated manner, this embodiment can also deploy a preset time threshold to represent timeliness. After intercepting the target message, contextual information is extracted from historical messages whose time interval with the target message does not exceed this preset time threshold (e.g., 10 minutes) based on the large language model.

[0045] The above are the steps for risk identification of the target message using the method of this embodiment. The risk identification result can be used to decide whether to take risk handling measures for the target message. Correspondingly, the method of this embodiment also includes the following steps:

[0046] S106, Perform target risk handling measures that match the risk identification results on the target message. The target risk handling measures are used to forward the target message to the message receiving end or to intercept the target message.

[0047] In this embodiment, the risk identification result includes the target risk level corresponding to the target message; correspondingly, this step can perform target risk handling measures that match the target message based on the preset mapping relationship between risk levels and risk handling measures.

[0048] As an example, risk levels and corresponding risk management measures may include:

[0049] The first risk level corresponds to a risk handling measure that involves adding a security alert to the target message.

[0050] The second risk level corresponds to the risk handling measures of adding security prompts to the target message and setting a removable masking layer on the original information area of ​​the target message before forwarding it to the message receiving end. The masking layer is used to block the display of the original information of the target message.

[0051] The third risk level corresponds to a risk handling measure that involves adding security alerts to the target message and forwarding the original information of the target message to the message receiver as a link to the security alerts.

[0052] The fourth risk level corresponds to risk handling measures used to intercept target messages and refuse to forward them to the message receiver.

[0053] As an example, see reference Figure 3 As shown, assuming the target message is a hyperlink to a 5G rich media service, the risk handling measures for the first risk level on the receiving end can be as follows: Figure 3 As shown in (a), this includes displaying a security warning message below the hyperlink button: "This message carries XX risk, please click with caution!"; the risk management measures for the second risk level can be as follows: Figure 3 As shown in (b), this includes using a masking layer to obscure the hyperlink interface of the 5G rich media service, displaying a security warning message "This message carries XX risk" on the masking layer, and a "View Still" option to cancel the masking layer; the risk handling measures for the third risk level can be as follows: Figure 3As shown in (c), this includes: providing a security prompt message "One piece of XX risk information has been filtered, but you can still view it," and displaying a hyperlink to the 5G rich media service as the "view it still" link; the risk handling measures for the fourth risk level can be as follows: Figure 3 As shown in (d), the receiving end cannot receive the target message.

[0054] For the functions mentioned above, please refer to Figure 1 As shown, the monitoring node in this embodiment is configured with functions including data acquisition, data processing, model training, model application, real-time detection, and real-time response.

[0055] Here, we take the example of a 5G messaging platform as the sending end and a 5G messaging user terminal as the receiving end.

[0056] The data acquisition function is mainly used to: obtain and record relevant information from the sender and / or receiver through a dedicated data interface connection to the 5G messaging platform and 5G messaging user terminals, such as: user profile, historical messages, historical message sending frequency, historical message time, links contained in historical messages, and content types of historical messages. This information is used to combine with target messages for risk identification.

[0057] The data processing function is mainly used to: perform invalid filtering and structured preprocessing on the relevant information obtained from the data acquisition function. In addition, it performs embedding encoding on the preprocessed relevant information to convert the relevant information into embedding vectors that can be directly used by the large language model.

[0058] The model training function is mainly used to train the risk identification capability of a large language model based on sample information (with risk labels already attached). The sample information can come from information intercepted from the sending end and related information, which has been converted into embedding vectors for representation by the data processing function.

[0059] The real-time detection function is mainly used to monitor the sending port of the sending device to intercept the target message sent by the sending device, and then call the large language model to complete risk identification.

[0060] The model application function is mainly used to: provide risk identification support for large language models for real-time detection, and can be regarded as an intelligent agent of large language models, providing prompt words, model parameters and other related configurations.

[0061] The real-time response function is mainly used to implement risk handling measures that match the risk identification results for the target message, so as to complete the corresponding rendering and display on the receiving end. For specific rendering and display effects, please refer to [reference needed]. Figure 3 As shown. It should be noted that, Figure 3The rendering effect shown can be configured on the monitoring node side or on the receiving end. If the configuration is completed on the receiving end, the monitoring node only needs to mark the target message with the corresponding risk level, that is, the action of "marking the risk level" is the risk handling measure; correspondingly, when the receiving end receives the target message, it can complete the corresponding rendering display of the target message according to the marked risk level.

[0062] In summary, the security mechanism built on a large language model for monitoring nodes in this embodiment has the following characteristics:

[0063] 1. High degree of automation: The introduction of large models significantly improves the speed and efficiency of real-time monitoring and analysis of 5G message content, while reducing the need for manual intervention and achieving adaptive security management;

[0064] 2. High flexibility: Utilizing deep learning technology, it can identify complex patterns and semantic relationships, detecting abnormal or inappropriate message content without explicit rules. Furthermore, the large language model supports monitoring various types of message content, such as text, images, audio, and video.

[0065] 3. High adaptability: The large language model can continuously iterate in real-world environments, improving the ability to identify and prevent new types of illegal messages and ensuring that the security mechanism remains forward-looking and timely.

[0066] In addition, corresponding to Figure 1 In addition to the method shown, another embodiment of this example also provides a message processing device. Figure 4 This is a schematic diagram of the message processing device 400, including:

[0067] The receiving module 410 is used to receive the target message sent by the message sending end to the message receiving end.

[0068] The identification module 420 is used to perform time-series encoding on the target message, the message sender and / or the message receiver based on a large language model, and to perform risk identification based on the time-series encoding results to obtain the corresponding risk identification results; wherein, the relevant information includes at least one of the sending pattern and content pattern of historical messages.

[0069] The above is an introduction to the modules of this embodiment used for risk identification of target messages. The risk identification results can be used to decide whether to take risk handling measures for the target message. Correspondingly, the device of this embodiment also includes:

[0070] An execution module is used to perform target risk handling measures on the target message that match the risk identification result. The target risk handling measures are used to forward the target message to the message receiving end or to intercept the target message.

[0071] The device in this embodiment is applied to a monitoring node on the message channel between the message sender and the message receiver. When the monitoring node receives a target message sent by the message sender, it performs time-series encoding on the target message and related information of the message sender and / or the message receiver, such as the sending frequency and content patterns of historical messages, based on a large language model. The risk is then identified based on the time-series encoding results. Essentially, it comprehensively assesses the risk based on the currently intercepted target message, combined with the historical message sending patterns and / or historical message content patterns of both the message sender and receiver. In relevant applications, the risk identification results can be used to decide whether to forward the target message to the message receiver or directly intercept the target message, thereby realizing a security protection mechanism against illegal information.

[0072] Optionally, before performing risk identification based on the target message, the message sender, and / or the message receiver using the large language model, the identification module 420 is further configured to: extract historical messages from the message sender and / or the message receiver based on the large language model to obtain context information, and add the context information to the target message, wherein the context information includes continuity information related to the target message.

[0073] Optionally, the recognition module 420 extracts context information from the historical messages of the message sender and / or the message receiver based on a large language model, including: performing intent recognition on the target message based on the large language model, and extracting context information that matches the intent recognition result from the historical messages of the message sender and / or the message receiver.

[0074] Optionally, the time interval between the historical messages of the message sending end and / or the message receiving end and the target message does not exceed a preset time threshold.

[0075] Optionally, the identification module 420 performs time-series encoding on the target message, the message sender, and / or the message receiver based on a large language model, and performs risk identification based on the time-series encoding results to obtain the corresponding risk identification results. This includes: performing time-series encoding on the target message, the message sender, and / or the message receiver based on a large language model, and performing positional encoding on the time-series encoding results using a Transformer self-attention mechanism to obtain the corresponding risk identification results.

[0076] Optionally, the risk identification result indicates the target risk level corresponding to the target message; the execution module performs risk handling measures on the target message that match the risk identification result, including: based on a preset mapping relationship between risk levels and risk handling measures, performing target risk handling measures on the target message that match the target message.

[0077] Optionally, the risk level includes a first risk level, and the risk handling measures corresponding to the first risk level are used to add security prompt information to the target message.

[0078] Optionally, the risk level includes a second risk level, and the risk handling measures corresponding to the second risk level are used to add security prompt information to the target message, and to set a removable masking layer on the area of ​​the original information of the target message before forwarding it to the message receiving end. The masking layer is used to block the target message from displaying the original information.

[0079] Optionally, the risk level includes a third risk level, and the risk handling measures corresponding to the third risk level are used to add security prompt information to the target message, and forward the original information of the target message to the message receiving end as the link content of the security prompt information.

[0080] Optionally, the risk level includes a fourth risk level, and the risk handling measures corresponding to the fourth risk level are used to intercept the target message so as to refuse to forward it to the message receiving end.

[0081] Optionally, the large language model is trained based on sample information and the risk level label corresponding to the sample information, wherein the risk level label is used to indicate the risk level corresponding to the sample information.

[0082] Optionally, the sending pattern includes: sending frequency and / or sending time; the content pattern includes: content links and / or content types.

[0083] Optionally, the relevant information of the message sender and / or the message receiver may also include: user profile.

[0084] Optionally, the message sending end includes one of a 5G messaging platform and a 5G messaging user terminal, and the message receiving end includes the other of the 5G messaging platform and the 5G messaging user terminal.

[0085] Optionally, the receiving module 410 receives the target message sent by the message sender to the message receiver, including: monitoring the message sending port of the message sender to obtain the target message when the message sender is detected sending the target message. It should be noted that the message processing device in this embodiment can be used as... Figure 1 The execution body of the method shown is therefore able to achieve... Figure 1 The steps and functions of the method shown are illustrated.

[0086] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Please refer to it. Figure 5 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0087] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0088] Memory is used to store computer programs. Specifically, a computer program may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides the computer program to the processor.

[0089] Specifically, the processor reads the corresponding computer program from non-volatile memory into memory and then runs it, forming the above-mentioned logical structure. Figure 4 The message processing device shown. Correspondingly, the processor executes the program stored in memory and specifically performs the following operations:

[0090] Obtain the target message sent by the message sender, which has not yet been received by the message receiver.

[0091] Based on a large language model, the relevant information of the target message, the message sender, and / or the message receiver is time-series encoded to obtain the time-series encoding result; and, based on the time-series encoding result, risk identification is performed to obtain the corresponding risk identification result; wherein, the relevant information includes at least one of the historical message sending pattern and content pattern.

[0092] The electronic device in this embodiment is applied to a monitoring node on the message channel between the message sender and the message receiver. When the monitoring node receives a target message sent by the message sender, it performs time-series encoding on the target message and related information of the message sender and / or the message receiver, such as the sending frequency and content patterns of historical messages, based on a large language model. The risk is then identified based on the time-series encoding results. Essentially, it comprehensively assesses the risk based on the currently intercepted target message, combined with the historical message sending patterns and / or historical message content patterns of both the message sender and receiver. In relevant applications, the risk identification results can be used to decide whether to forward the target message to the message receiver or directly intercept the target message, thereby realizing a security protection mechanism against illegal information.

[0093] The above is as described in this instruction manual. Figure 1The method for judging illegal web pages disclosed in the illustrated embodiments can be applied to a processor and implemented by the processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit in the processor or by instructions in the form of software. The processor mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly reflected as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0094] Of course, in addition to software implementation, the electronic device described in this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0095] Furthermore, embodiments of this application also propose a computer-readable storage medium that stores one or more computer programs, the one or more computer programs including instructions.

[0096] When the aforementioned instructions are executed by a portable electronic device that includes multiple applications, they enable the portable electronic device to perform... Figure 1 The steps in the method shown include:

[0097] Obtain the target message sent by the message sender, which has not yet been received by the message receiver.

[0098] Based on a large language model, the relevant information of the target message, the message sender, and / or the message receiver is time-series encoded to obtain the time-series encoding result; and, based on the time-series encoding result, risk identification is performed to obtain the corresponding risk identification result; wherein, the relevant information includes at least one of the historical message sending pattern and content pattern.

[0099] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0101] The above are merely embodiments of this specification and are not intended to limit the scope of this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification. Furthermore, all other embodiments obtained by those skilled in the art without inventive effort should fall within the protection scope of this document.

Claims

1. A message processing method applied to a monitoring node, wherein the monitoring node is deployed on a message channel between a message sender and a message receiver, characterized in that, The method includes: Receive the target message sent by the message sender to the message receiver; The target message, the message sender, and / or the message receiver are temporally encoded based on a large language model, and the temporal encoding result is positionally encoded using a Transformer self-attention mechanism to obtain a corresponding risk identification result, wherein the risk identification result indicates the target risk level corresponding to the target message; and risk identification is performed based on the temporal encoding result to obtain a corresponding risk identification result; wherein the relevant information includes at least one of the sending pattern and content pattern of historical messages; Based on the preset mapping relationship between risk levels and risk handling measures, target risk handling measures that match the target message are executed on the target message.

2. The method according to claim 1, characterized in that, Before performing risk identification based on the target message, the message sender, and / or the message receiver using a large language model, the method further includes: Based on a large language model, historical messages from the message sender and / or the message receiver are extracted to obtain context information, which is then added to the target message. The context information includes continuity information related to the target message.

3. The method according to claim 2, characterized in that, Based on a large language model, historical messages from the message sender and / or the message receiver are extracted to obtain context information, including: The intent of the target message is identified based on a large language model, and contextual information matching the intent identification result is extracted from the historical messages of the message sender and / or the message receiver.

4. The method according to claim 2, characterized in that, The time interval between the historical messages of the message sending end and / or the message receiving end and the target message does not exceed a preset time threshold.

5. The method according to claim 1, characterized in that, The risk level includes a first risk level, and the risk handling measures corresponding to the first risk level are used to add security prompt information to the target message.

6. The method according to claim 5, characterized in that, The risk level includes a second risk level. The risk handling measures corresponding to the second risk level are used to add security prompt information to the target message and set a removable masking layer on the area of ​​the original information of the target message before forwarding it to the message receiving end. The masking layer is used to block the target message from displaying the original information.

7. The method according to claim 1, characterized in that, The risk level includes a third risk level. The risk handling measures corresponding to the third risk level are used to add security prompt information to the target message, and then forward the original information of the target message to the message receiving end as the link content of the security prompt information.

8. The method according to claim 1, characterized in that, The risk level includes a fourth risk level, and the risk handling measures corresponding to the fourth risk level are used to intercept the target message so as to refuse to forward it to the message receiving end.

9. The method according to claim 1, characterized in that, The large language model is trained based on sample information and the risk level labels corresponding to the sample information. The risk level labels are used to indicate the risk level corresponding to the sample information.

10. The method according to any one of claims 1 to 4, characterized in that, The sending patterns include: sending frequency and / or sending time; the content patterns include: content links and / or content types.

11. The method according to any one of claims 1 to 4, characterized in that, The message sending end includes one of a 5G messaging platform and a 5G messaging user terminal, and the message receiving end includes the other of the 5G messaging platform and the 5G messaging user terminal.

12. The method according to any one of claims 1 to 4, characterized in that, Receiving the target message sent by the message sender to the message receiver includes: The message sending port of the message sending end is monitored to obtain the target message when the message sending end is detected to be sending the target message.

13. A message processing device applied to a monitoring node, the monitoring node being deployed on a message channel between a message sender and a message receiver, characterized in that, The device includes: The receiving module is used to receive the target message sent by the message sender to the message receiver; The identification module is configured to perform temporal encoding on the target message, the message sender, and / or the message receiver based on a large language model, and to perform positional encoding on the temporal encoding result using a Transformer self-attention mechanism to obtain a corresponding risk identification result, wherein the risk identification result indicates the target risk level corresponding to the target message; and to perform risk identification based on the temporal encoding result to obtain a corresponding risk identification result; wherein the relevant information includes at least one of the sending pattern and content pattern of historical messages; and to execute target risk handling measures matching the target message based on a preset mapping relationship between risk levels and risk handling measures.

14. An electronic device comprising: processor; And a memory arranged to store computer-executable instructions, characterized in that, when executed, the executable instructions cause the processor to perform the method as described in any one of claims 1 to 12.

15. A computer program product, the computer program product comprising a computer-readable storage medium storing a computer program, characterized in that, The computer program is operable to cause the computer to perform the method as described in any one of claims 1 to 12.

Images