Junk mail classification method and device, equipment and storage medium

Abstract

The invention discloses a junk mail classification method, device and equipment and a storage medium. The junk mail classification method, device and equipment are realized through an extraction module, a detection module, a classification module and a disposal module. The extraction module can be determined according to specific requirements of junk mail classification, the detection module adopts multiple fusion feature vector technologies based on an LLM pre-training model and feature engineering to realize multi-modal detection of metadata, texts, pictures, hyperlinks and vision of junk mails, and the classification module can perform classification on the junk mails based on fusion feature vectors. By using a TabNet mode, the capability of learning features is improved, further subdivision of the junk mails / mails is realized, and meanwhile, a disposal module provides custom configuration for a user, so that the customized and automatic disposal requirements of the user on the junk mails / mails can be met. According to the scheme, the detection accuracy of junk mails is improved, more personalized settings can be provided, a user can better manage mail classification rules, misinformation is reduced, and it is ensured that valuable mails cannot be classified mistakenly.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a spam classification method, device, equipment and storage medium. Background Art

[0002] In the current digital communication environment, email is widely used as the main communication tool, but the proliferation of spam is still one of the main challenges faced by users and organizations. Although existing spam detection systems can identify most common spam, such as advertising promotion, malware and phishing attack emails, these systems still have obvious limitations in accuracy. Especially when faced with a large number of legitimate bulk emails, such as business promotions, system update reminders, academic conference invitations or local news subscribed by users, these emails are valuable to customers in some cases, and customers are willing to accept such emails, but such emails are often classified as spam, which leads to false positives for users. These emails are easily misclassified as spam because of their similarity with spam in content and format, or because of their high frequency of sending. At the same time, the existing detection system lacks further detailed classification of spam types and customized processing based on further classification, resulting in the inability to accurately distinguish different types of emails based on users' subscription behavior or interests. In addition, most spam detection systems are opaque to users, lack explanatory and customizable options, and users cannot easily adjust the classification criteria to meet their specific needs.

[0003] Specifically, using spam identification technology to identify spam has become an important part of email security. However, spam identification currently has a low recognition rate, and some valuable emails are mistakenly classified as spam, such as business promotions, system update reminders, and academic conference invitations that users subscribe to on their own. This causes customers to miss notifications or reminders that may be relevant to them, limiting the value of normal emails.

[0004] Therefore, technicians in this field are committed to developing a more intelligent and flexible spam classification method, device, electronic device and computer-readable storage medium to reclassify possible spam, identify which are valuable emails and which are worthless spam, use more accurate email classification methods to identify real spam, improve spam recognition rate and optimize spam personalization settings, and improve email security and value. Summary of the invention

[0005] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is to further classify spam more accurately, identify real spam, improve the spam recognition rate and optimize the personalized settings of spam, and improve email security and commercial email value.

[0006] To achieve the above purpose, the present invention provides a spam classification method, device, electronic device and computer-readable storage medium, which can combine artificial intelligence and deep learning technologies, and use a variety of detection technologies and classification technologies to more accurately further classify spam, which not only improves the accuracy of spam detection, but also provides more personalized settings, so that users can better manage email classification rules, reduce false positives, and ensure that valuable emails are not misclassified. .

[0007] In a first aspect, the present solution provides a method for classifying spam emails, including the steps of extracting email data, detecting emails from multiple dimensions, classifying based on fusion features, and handling emails.

[0008] Among them, the extracted email data is to extract various target fields related to the sender, recipient, cc, subject, body, and attachments in the email data through an extraction module to form a field set, and also includes multimedia, hyperlinks and the presentation effect of the entire email that may exist in the body or attachments; the presentation effect of the email refers to the judgment of whether the email is spam by simulating human observation ability through the CV detection module. Specifically, the visual presentation effect of the email refers to the presentation form and characteristics of the email at the human visual level, and the characteristics include but are not limited to one or more of the email's layout, font and text characteristics, image content, color matching and style, and brand characteristics.

[0009] The detection of emails from multiple dimensions is to call several detection sub-modules to detect the data extracted by the extraction module and output feature vector results; the detection sub-modules include one or more of feature engineering detection modules, LLM detection modules, CV detection modules and hyperlink detection modules.

[0010] The classification based on fusion features is performed by a classification module according to an unsupervised classification method based on the email feature vector, and a score number of each type is generated.

[0011] The email processing is to process the emails according to the strategy and the email type and score generated by the classification module. The email processing can be one or any combination of blocking, warning, reminder, release, and unsubscription strategies.

[0012] Furthermore, the feature engineering detection module extracts the metadata of the email and converts it into a numerical or vector representation that can be used for machine learning model processing and learning, and then uses a convolutional neural network or a recurrent neural network to classify spam emails; the metadata may be one or more of From, MailFrom, To, CC / BCC, Subject, Reply-To, Message-ID.

[0013] Furthermore, the specific processing steps of the feature engineering detection module are: first, the metadata is preprocessed and feature engineered, the preprocessing can be standardized fields, and the feature engineering can be to create combined features; then, the processed data is input into the model, and the model can use a convolutional neural network to capture local features, or use a recurrent neural network to identify long dependencies in time series or sequences in numerical values ​​or vectors; finally, the model is trained to distinguish between spam and normal emails, thereby achieving effective spam judgment.

[0014] Furthermore, the LLM detection module uses the data of the entire email, including all data related to the sender, recipient, CC, subject, body, and attachments as input for unified detection, and outputs a feature vector of the entire email; the LLM detection module converts the data of the entire email into Tokens, and the pre-training task can select the BERT mask prediction task or the ELECTRA task of replacing random words.

[0015] Furthermore, the CV detection module implements computer vision color detection, and the main detection objects are the pictures contained in the entire email and the performance effect of the entire email for visual analysis; the extraction module extracts the pictures in the email, and extracts the performance effect of the email in the form of pictures, that is, the visual effect of the email on people. The CV detection module uses a pre-trained model to extract image features, and the pre-trained model can be one of CNN, ResNet, Inception, VGG; computer vision technology is used to detect images in emails and the performance effects of emails, so as to identify spam and perform further classification.

[0016] Furthermore, the hyperlink detection module detects hyperlinks in the email body or identifiable attachments, and the extraction module extracts features from the links. The features extracted from the links include but are not limited to one or more of character length, special character ratio, and common subdomain names, which are input into the hyperlink detection module. The hyperlink detection module uses the trained model to classify them as normal links or malicious links.

[0017] Furthermore, the feature vectors output by the detection modules are concatenated to form a fused feature vector to maintain the independence of the results of each detection module, and the concatenated fused feature vector is input into the classification module. The classification module can use the TabNet method to take the tabular data, i.e., the fused feature vector, as input and the spam category or possibility or score as output.

[0018] Furthermore, the disposal module takes the spam category or score output by the classification module as input, and processes specific spam categories in combination with default strategies or customized strategies. The processing means may be one or more of blocking, alarming, reminding, and releasing strategies, or dynamically modify the above disposal strategies based on the customer's behavior on emails; it may also automatically unsubscribe from unsubscribeable emails on demand; the customer may modify the strategies in the disposal module, and the modifiable strategies may be to release or block commercial promotion emails and news notification emails.

[0019] In the second aspect, this scheme provides a spam classification device, the device structure mainly includes an extraction module, a detection module, a classification module, and a disposal module, and adopts the spam classification method as mentioned above. The extraction module is used to extract the target fields related to the sender, recipient, CC, subject, body, and attachment in the email data to form a field set, and also includes the multimedia, hyperlinks and the performance effect of the entire email that may exist in the body or attachment; the detection module calls several detection submodules to detect the data extracted by the extraction module and output the feature vector result; the detection submodule includes a feature engineering detection module, an LLM detection module, a CV detection module and a hyperlink detection module; the classification module splices the output feature vectors of each detection submodule into an email fusion feature vector, classifies according to the classification method of deep learning such as TabNet, and generates scores of various types; the disposal module disposes the email according to the strategy and the email type or score generated by the classification module, and the email disposal can be divided into different strategies: blocking, warning, reminder, release, and unsubscription. In addition, customers can modify the strategy in the disposal module to release or block commercial promotion emails and news notification emails.

[0020] In a third aspect, the present solution provides an electronic device, comprising a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program to implement the steps of any of the aforementioned spam classification methods.

[0021] In a fourth aspect, the present solution provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program is used to implement the steps of any of the spam classification methods described above.

[0022] This solution combines technologies such as artificial intelligence and deep learning to further segment spam, which not only improves the accuracy of spam detection, but also provides more personalized settings, allowing users to better manage email classification rules and reduce false positives, ensuring that valuable emails are not misclassified. This system will optimize the customization of spam detection through more detailed email classification and the combination of user behavior and interests, thereby improving the overall user experience.

[0023] Through this solution, customers can handle different types of spam differently. This overcomes the problem in previous patents that spam is handled uniformly and cannot be further classified and processed. For example, previous patents divide emails into spam A and normal emails B, and handle A in a consistent manner. Based on the classification of spam A, this patent further classifies it into A1 subscription emails, A2 advertising emails, A3 news emails, etc., and processes multiple categories such as A1, A2, A3, etc. This can avoid some users who want to see A1 type emails but do not want to see A2 and A3 type emails.

[0024] Technical Effects

[0025] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is an overall flow chart of a method for classifying spam in a preferred embodiment of the present invention;

[0027] Figure 2 It is a specific implementation flow chart of a method for classifying spam in a preferred embodiment of the present invention;

[0028] Figure 3 It is a structural diagram of a spam classification device according to a preferred embodiment of the present invention;

[0029] Figure 4 It is a structural diagram of an electronic device for classifying spam according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following describes several preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.

[0031] In the drawings, components with the same structure are indicated by the same numerical reference numerals, and components with similar structures or functions are indicated by similar numerical reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present invention does not limit the size and thickness of each component. In order to make the illustration clearer, the thickness of the components is appropriately exaggerated in some places in the drawings.

[0032] like Figure 1 As shown, Embodiment 1 is a preferred embodiment of the present application, which implements a spam classification method, mainly including:

[0033] S101: extracting email data, extracting various target fields related to sender, recipient, CC, subject, body, and attachments from the email data to form a field set, and also including possible multimedia, hyperlinks, and the presentation effect of the entire email in the body or attachments;

[0034] S102: Detect the email from multiple dimensions, call each detection submodule to detect the data extracted by the extraction module, and output the feature vector result. The detection submodule includes a feature engineering detection module, an LLM detection module, a CV detection module, and a hyperlink detection module.

[0035] S103: Classify based on the fusion features, classify according to the email feature vector using an unsupervised classification method, and generate a score for each type.

[0036] S104: Email processing: processing emails according to the strategy and the email type and score generated by the classification module. Email processing can be divided into different strategies such as blocking, warning, reminding, releasing, and unsubscribing.

[0037] Among them, the extraction module is responsible for extracting relevant target information of the email on the email server, extracting various target fields related to the sender, recipient, cc, subject, body, and attachment in the email data to form a field set, and also includes multimedia, hyperlinks and the presentation effect of the entire email that may exist in the body or attachments.

[0038] The presentation effect refers to the visual effect of the entire email in the eyes of the recipient, because many spam emails are advertisements and notification emails, most of which attract attention in a fixed form. Compared with normal emails, people can make a certain degree of judgment from their perspective. The presentation effect of the email refers to the judgment of whether the email is spam by simulating the observation ability of people through the CV detection module.

[0039] The feature engineering detection module can extract the metadata of the email (such as From, MailFrom, To, CC / BCC, Subject, Reply-To, Message-ID, etc.) and convert it into an appropriate format, and then use a convolutional neural network (CNN) or a recurrent neural network (RNN) to classify spam. First, the metadata is preprocessed and feature engineered, such as standardizing fields and creating combined features. Next, the processed data is input into the model, CNN can be used to capture local features, and RNN can identify long dependencies in sequences. Finally, the model is trained to distinguish between spam and normal emails, thereby achieving effective spam judgment.

[0040] The LLM detection module uses the data of the entire email, including all data related to the sender, recipient, CC, subject, body, and attachments, as input for unified detection, and outputs the feature vector of the entire email. This module converts the data of the entire email into Tokens, and the pre-training task is to replace ELECTRA with random words.

[0041] The main advantage of using ELECTRA in the LLM detection module in this embodiment is that the training efficiency is higher, the replacement word detection task is used to avoid the waste of mask word data, and the parameter scale is smaller and the computing resource requirements are lower. In downstream tasks, ELECTRA achieves performance comparable to or even better than BERT at a lower cost, which is very suitable for actual industrial deployment and resource-constrained scenarios.

[0042] The CV detection module implements computer vision color detection, and the main detection objects are the pictures contained in the entire email and the visual analysis of the performance of the entire email. The extraction module extracts the pictures in the email and extracts the performance of the email in the form of pictures, that is, the visual effect of the email on people. The CV module can use pre-trained CNN, ResNet, Inception, VGG, etc. to extract image features, thereby realizing the use of computer vision technology to detect images in emails and the performance of emails, so as to identify spam and further classify it.

[0043] Optionally, the hyperlink detection module can detect hyperlinks in the email body or identifiable attachments. The extraction module extracts features (such as character length, special character ratio, common subdomains, etc.) from the link and inputs them into the hyperlink detection module. The hyperlink detection module uses the trained model for classification (normal link or malicious link).

[0044] Furthermore, the feature vectors outputted by the above-mentioned detection modules are spliced ​​to form a fused feature vector to maintain the independence of the results of each detection module, and the spliced ​​fused feature vector is input into the classification module. The fused feature vector highlights the features that have a greater impact on the classification task, improves the model's explanatory power, and improves the classification accuracy. The classification module can use the TabNet method to take tabular data, i.e., the fused feature vector, as input, and further spam categories and possibilities, or scores as output. This method combines the advantages of decision trees and neural network models, and improves the ability to learn features by using a sequential attention mechanism in each decision step to select features for reasoning.

[0045] Through the fused feature vector processing method adopted in this embodiment, a new email representation framework is proposed, that is, the common feature fusion module of emails is introduced in the pre-training process, which significantly improves the pre-training model's ability to represent traffic features, improves its accuracy in classification tasks, and enhances the interpretability of the model.

[0046] Furthermore, the disposal module uses the spam categories and scores output by the classification module as input, and processes specific spam categories in combination with default strategies or customized strategies, such as blocking, warning, reminder, release, and other different strategies. At the same time, it can also automatically unsubscribe emails that can be unsubscribed on demand. In addition, customers can modify the strategies in the disposal module, such as releasing or blocking some commercial promotion emails, news notification emails, etc., to achieve more detailed email classification and the combination of user behavior and interests, optimize the customization of spam detection, and thus improve the overall user experience.

[0047] like Figure 2 As shown, as a specific embodiment, the spam detection method provided in the first embodiment of the present application is based on the above content, and in the detection process of each detection module, further includes:

[0048] Each detection model can be integrated with each blacklist and whitelist library. For example, the hyperlink detection module can use the hyperlink to compare with the known malicious website blacklist, such as using some open source blacklists or third-party services (such as Google Safe Browsing API, PhishTank, etc.) to check whether the link is safe. The feature engineering module can use the blacklist and whitelist of emails to compare the sender information for rapid detection.

[0049] like Figure 2 As shown, as a specific embodiment, the spam handling method provided in the first embodiment of the present application, based on the above content, further includes:

[0050] The disposal module can adjust the disposal strategy based on real-time feedback such as the length of time users spend reading specific emails and the frequency of clicks, and further relax security checks and adjust scoring strategies for spam categories that users are interested in, in order to achieve dynamic spam security detection and disposal.

[0051] See also Figure 3 As shown, Embodiment 2 is another preferred embodiment of the present application, which discloses a spam classification device, mainly comprising:

[0052] The extraction module 301 is used to extract various target fields related to the sender, recipient, CC, subject, body, and attachments in the email data to form a field set, and also includes multimedia, hyperlinks, and the presentation effect of the entire email that may exist in the body or attachments.

[0053] The detection module 302 calls each detection submodule to detect the data extracted by the extraction module and outputs the feature vector result. The detection submodule includes a feature engineering detection module, an LLM detection module, a CV detection module and a hyperlink detection module.

[0054] The classification module 303 combines the output feature vectors of the detection submodules into an email fusion feature vector, performs classification according to a deep learning classification method such as TabNet, and generates a score number for each type.

[0055] The processing module 304 processes the emails according to the policies and the email types and scores generated by the classification module. The email processing can be divided into different policies such as blocking, warning, reminder, release, and unsubscription. In addition, the customer can modify the policies in the processing module, such as releasing or blocking some commercial promotion emails, news notification emails, etc., to achieve more detailed email classification and the combination of user behavior and interests, optimize the customization of spam detection, and thus improve the overall user experience.

[0056] It can be seen that the spam classification device disclosed in the embodiment of the present application uses multiple detection submodules and classification modules to classify spam in detail, and the disposal module selects the disposal action for spam based on the classification result, thereby effectively improving the accuracy of spam detection and greatly improving the security, convenience and value of email use.

[0057] For the specific content of the above-mentioned spam classification device, please refer to the detailed introduction of the above-mentioned spam classification method, which will not be repeated here.

[0058] As a specific embodiment, in the spam classification device implemented in the second embodiment of the present application, based on the above content, the extraction module 301 extracts the corresponding information in the email data, specifically for:

[0059] The target fields related to the sender, recipient, CC, subject, body, and attachments in the email data are extracted to form a field set, which also includes the multimedia, hyperlinks and the presentation effect of the entire email that may exist in the body or attachments.

[0060] The performance effect of the email refers to judging whether the email is a spam email by simulating human observation ability through the CV detection module.

[0061] As a specific embodiment, the spam classification device disclosed in the second embodiment of the present application further includes:

[0062] The detection module includes a feature engineering detection module, an LLM detection module, a CV detection module and a hyperlink detection module, which respectively detect structured data such as senders, recipients, CCs, hyperlinks, etc., detect the data of the entire email, detect the images contained in the entire email and the performance of the entire email, and detect hyperlinks in the email body or attachments.

[0063] As a specific embodiment, the spam classification device disclosed in the second embodiment of the present application is based on the above content, and the calling module 302 is specifically used to call each detection module for processing:

[0064] The feature engineering detection module can extract the metadata of the email (such as From, MailFrom, To, CC / BCC, Subject, Reply-To, Message-ID, etc.) and convert it into an appropriate format, and then use a convolutional neural network (CNN) or a recurrent neural network (RNN) to classify spam emails.

[0065] The LLM detection module uses the data of the entire email, including all data related to the sender, recipient, CC, subject, body, and attachments, as input for unified detection, and outputs a feature vector of the entire email.

[0066] The CV detection module implements computer vision color detection, and its main detection objects are the images contained in the entire email and the visual analysis of the performance of the entire email.

[0067] The hyperlink detection module can detect hyperlinks in the email body or identifiable attachments, and the extraction module extracts features from the links.

[0068] As a specific embodiment, the spam classification device disclosed in the second embodiment of the present application, based on the above content, calls the classification module 303 to splice the feature vectors generated by each detection module to form a fused feature vector, which is specifically used for:

[0069] Classification is performed according to the email feature vector using an unsupervised classification method, and a score number for each type is generated.

[0070] As a specific embodiment, the spam classification device disclosed in the second embodiment of the present application, based on the above content, calls the processing module 304 to further process the spam types and scores generated by the classification module, specifically for:

[0071] The emails are processed according to the strategy and the email types and scores generated by the classification module. The email processing can be divided into different strategies such as blocking, warning, reminding, releasing, and unsubscribing.

[0072] See also Figure 4 As shown, Embodiment 3 is another preferred embodiment of the present application, and discloses an electronic device, including:

[0073] Memory 401, used for storing computer programs;

[0074] The processor 402 is configured to execute the computer program to implement the steps of any one of the spam classification methods described above.

[0075] Furthermore, as another preferred embodiment of the present application, Embodiment 4 also discloses a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the steps of any of the spam classification methods described above.

[0076] For specific contents of the above-mentioned electronic device and computer-readable storage medium, please refer to the detailed introduction of the above-mentioned spam classification method, which will not be repeated here.

[0077] In this application, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0078] The preferred specific embodiments of the present invention are described in detail above. It should be understood that ordinary technicians in the field can make many modifications and changes based on the concept of the present invention without creative work. Therefore, all technical solutions that can be obtained by technicians in the technical field based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A method for classifying spam, characterized in that: The steps include: extracting email data, detecting emails from multiple dimensions, classifying based on fusion features, and handling modules; The email data is extracted by extracting various target fields related to the sender, recipient, CC, subject, body, and attachments in the email data through an extraction module to form a field set, and also includes multimedia, hyperlinks and the performance effect of the entire email that may exist in the body or attachments; the email performance effect refers to the judgment of whether the email is spam by simulating human observation ability through the CV detection module; specifically, the visual performance effect of the email refers to the presentation form and characteristics of the email at the human visual level, and the characteristics include but are not limited to one or more of the email layout, font and text characteristics, image content, color matching and style, and brand characteristics; The detection of emails from multiple dimensions is to call several detection submodules to detect the data extracted by the extraction module and output feature vector results; the detection submodules include one or more of feature engineering detection module, LLM detection module, CV detection module and hyperlink detection module; The classification based on fusion features is performed by the classification module according to the email feature vector in an unsupervised classification method, and a score number of each type is generated; The email processing is to process the emails according to the strategy and the email type and score generated by the classification module. The email processing can be one or any combination of blocking, warning, reminder, release, and unsubscription strategies.

2. The method for classifying spam according to claim 1, characterized in that: The feature engineering detection module extracts the metadata of the email and converts it into a numerical or vector representation that can be used for machine learning model processing and learning, and then uses a convolutional neural network or a recurrent neural network to classify spam emails; the metadata can be one or more of From, MailFrom, To, CC / BCC, Subject, Reply-To, and Message-ID; The specific processing steps of the feature engineering detection module are as follows: first, the metadata is preprocessed and feature engineered, the preprocessing can be to standardize fields, and the feature engineering can be to create combined features; then, the processed data is input into the model, and the model can use a convolutional neural network to capture local features, or use a recurrent neural network to identify long dependencies in time series or sequences in numerical values ​​or vectors; finally, the model is trained to distinguish between spam and normal emails, thereby achieving effective spam judgment.

3. The method for classifying spam according to claim 1, characterized in that: The LLM detection module uses the data of the entire email, including all data related to the sender, recipient, CC, subject, body, and attachments as input for unified detection, and outputs the feature vector of the entire email; the LLM detection module converts the data of the entire email into Tokens, and the pre-training task can choose to replace ELECTRA with random words. The main advantage of ELECTRA over BERT is that it has higher training efficiency, and the use of replacement word detection tasks avoids the waste of mask word data. At the same time, the parameter scale is smaller and the computing resource requirements are lower. In downstream tasks, ELECTRA achieves performance that is equal to or even exceeds BERT at a lower cost, which is very suitable for actual industrial deployment and resource-constrained scenarios.

4. The method for classifying spam according to claim 1, characterized in that: The CV detection module implements computer vision color detection, and the main detection objects are the pictures contained in the entire email and the performance effect of the entire email for visual analysis; the extraction module extracts the pictures in the email, and extracts the performance effect of the email in the form of pictures, that is, the visual effect of the email on people. The CV detection module uses a pre-trained model to extract image features. The pre-trained model can be one of CNN, ResNet, Inception, and VGG; computer vision technology is used to detect images in emails and the performance effects of emails, so as to identify spam and perform further classification.

5. The method for classifying spam according to claim 1, characterized in that: The hyperlink detection module detects hyperlinks in the email body or identifiable attachments, and the extraction module extracts features from the links. The features extracted from the links include but are not limited to one or more of character length, special character ratio, and common subdomain names, which are input into the hyperlink detection module. The hyperlink detection module uses a trained model to classify the links into normal links or malicious links.

6. The method for classifying spam according to claim 1, characterized in that: The feature vectors output by the detection module are spliced ​​to form a fused feature vector to maintain the independence of the results of each detection module, and the spliced ​​fused feature vector is input into the classification module. The classification module can use the TabNet method to take the tabular data, i.e., the fused feature vector as input and the spam category or possibility or score as output.

7. The spam classification method according to claim 1, characterized in that: The processing module takes the spam category or score output by the classification module as input, and processes the specific spam category in combination with the default strategy or the customer-customized strategy. The processing means may be one or more of the blocking, warning, reminder, and release strategies, or dynamically modify the above processing strategies according to the customer's behavior on the emails; it can also automatically unsubscribe the unsubscribeable emails on demand; The customer can modify the policies in the disposal module. The modifiable policies can be to release or block commercial promotion emails and news notification emails.

8. A spam classification device, characterized in that: It mainly includes an extraction module, a detection module, a classification module, and a disposal module, and adopts any one of the spam classification methods described in claims 1-7; The extraction module is used to extract various target fields related to the sender, recipient, CC, subject, body, and attachments in the email data to form a field set, and also includes multimedia, hyperlinks, and the presentation effect of the entire email that may exist in the body or attachments; The detection module calls several detection submodules to detect the data extracted by the extraction module and outputs the feature vector results; The detection submodules include feature engineering detection module, LLM detection module, CV detection module and hyperlink detection module; The classification module splices the output feature vectors of each detection submodule into an email fusion feature vector, classifies the emails according to deep learning classification methods such as TabNet, and generates a score for each type. The handling module handles emails based on the strategies and email types or scores generated by the classification module. Email handling can be divided into different strategies: blocking, warning, reminder, release, and unsubscribe. In addition, customers can modify the strategies in the handling module to release or block commercial promotion emails and news notification emails.

9. An electronic device comprising a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program to implement the steps of any one of the spam classification methods according to claims 1-7.

10. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the computer program is used to implement the steps of any spam classification method according to claims 1-7.

Images