A method, apparatus, device and storage medium for classifying spam emails.

Abstract

This invention discloses a spam classification method, apparatus, device, and storage medium, implemented through an extraction module, a detection module, a classification module, and a disposal module. The extraction module can be customized according to the specific needs of spam classification. The detection module employs multiple fusion feature vector techniques based on an LLM pre-trained model and feature engineering to achieve multimodal detection of spam metadata, text, images, hyperlinks, and visual data. The classification module, based on the fusion feature vectors, uses TabNet to enhance the ability to learn features and further subdivide spam / emails. Simultaneously, the disposal module provides user-customizable configurations to meet users' needs for customized and automated spam / email disposal. This solution not only improves the accuracy of spam detection but also provides more personalized settings, enabling users to better manage email classification rules, reduce false positives, and ensure that valuable emails are not misclassified.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method, apparatus, device, and storage medium for classifying spam. Background Technology

[0002] In today's digital communication environment, email is widely used as a primary communication tool, but the proliferation of spam remains one of the major challenges for users and organizations. While existing spam detection systems can identify most common spam, such as advertising, malware, and phishing emails, these systems still have significant limitations in accuracy. This is especially true when faced with large volumes of legitimate emails, such as business promotions, system update reminders, academic conference invitations, or local news. These emails are valuable to customers in some cases, and customers are willing to receive them, but they are often classified as spam, leading to false positives. These emails are easily misjudged as spam due to their similarity to spam in content and format, or because of their high frequency of sending. At the same time, existing detection systems lack further detailed classification of spam types and customized processing based on further classification, making it impossible to accurately distinguish different types of emails based on user subscription behavior or interests. Furthermore, most spam detection systems are opaque to users, lacking explanatory and customizable options, making it difficult for users to easily adjust classification criteria to meet their specific needs.

[0003] Specifically, using spam detection technology to identify spam has become an important part of email security. However, current spam detection suffers from low accuracy and also misclassifies some valuable emails as spam, such as business promotions, system update reminders, and academic conference invitations that users have subscribed to. This causes customers to miss notifications or reminders that they may not be aware of, thus limiting the value of legitimate emails.

[0004] Therefore, those skilled in the art are dedicated to developing a more intelligent and flexible spam classification method, device, electronic device, and computer-readable storage medium to reclassify potential spam, identify which emails are valuable and which are worthless spam, use more accurate email classification methods to identify genuine spam, improve spam identification rates, optimize spam personalization settings, and enhance email security and value. Summary of the Invention

[0005] In view of the above-mentioned deficiencies of the prior art, the technical problem to be solved by the present invention is to more accurately classify spam emails, identify real spam emails, improve the spam email identification rate, optimize spam email personalization settings, and improve email security and the value of business emails.

[0006] To achieve the above objectives, this invention provides a method, apparatus, electronic device, and computer-readable storage medium for classifying spam emails. It combines artificial intelligence and deep learning technologies, utilizing multiple detection and classification techniques to more accurately classify spam emails. This not only improves the accuracy of spam detection but also provides more personalized settings, enabling users to better manage email classification rules, reduce false positives, and ensure that valuable emails are not misclassified.

[0007] Firstly, this solution provides a method for classifying spam emails, including the following steps: extracting email data, detecting emails from multiple dimensions, classifying emails based on fusion features, and handling emails.

[0008] The extraction of email data involves using an extraction module to extract target fields related to sender, recipient, CC, subject, body, and attachments from the email data, forming a field set. This also includes multimedia, hyperlinks, and the overall presentation of the email, which may exist in the body or attachments. The presentation of the email refers to the judgment of whether an email is spam by a CV detection module that simulates human observation. Specifically, the visual presentation of the email refers to the presentation form and characteristics of the email at the human visual level. These characteristics include, but are not limited to, one or more of the following: email layout, font and text features, image content, color scheme and style, and brand characteristics.

[0009] The process of detecting emails from multiple dimensions involves calling several detection sub-modules to detect the data extracted by the extraction module and outputting feature vector results. The detection sub-modules include one or more of the following: feature engineering detection module, LLM detection module, CV detection module, and hyperlink detection module.

[0010] The classification based on fusion features is performed by the classification module according to the email feature vector using an unsupervised classification method, and then generates a score for each type.

[0011] The email handling is based on the policy and the email type and score generated by the classification module. The email handling can be one or any combination of blocking, alarm, reminder, allow, and unsubscribe policies.

[0012] Furthermore, the feature engineering detection module extracts the metadata of the emails and converts it into a numerical or vector representation that can be processed and learned by machine learning models. Then, a convolutional neural network or a recurrent neural network is used to classify spam emails. The metadata can be one or more of From, MailFrom, To, CC / BCC, Subject, Reply-To, and Message-ID.

[0013] Furthermore, the specific processing steps of the feature engineering detection module are as follows: First, the metadata is preprocessed and feature-engineered. Preprocessing can be standardized fields, and feature engineering can be the creation of combined features. Next, the processed data is input into the model. The model can use a convolutional neural network to capture local features, or a recurrent neural network to identify long-term or sequential dependencies in numerical values ​​or vectors. Finally, the model is trained to distinguish between spam and legitimate emails, thereby achieving effective spam detection.

[0014] Furthermore, the LLM detection module uses all data related to the entire email, including sender, recipient, CC, subject, body, and attachments, as input for unified detection and outputs the feature vector of the entire email. The LLM detection module converts the data of the entire email into tokens, and the pre-training task can be either the BERT mask prediction task or the ELECTRA task that replaces random words.

[0015] Furthermore, the CV detection module performs computer vision color detection, primarily detecting the images contained in the entire email and performing visual analysis of the overall email presentation. The extraction module extracts images from the email and extracts the email's presentation as images, i.e., the email's visual effect on humans. The CV detection module uses a pre-trained model to extract image features; the pre-trained model can be one of CNN, ResNet, Inception, or VGG. Computer vision technology is used to detect images in the email and the email's presentation, thereby identifying spam and performing further classification.

[0016] Furthermore, the hyperlink detection module detects hyperlinks in the email body or identifiable attachments. The extraction module extracts features from the links, including but not limited to character length, proportion of special characters, and one or more common subdomains. These features are then input into the hyperlink detection module, which uses a trained model to classify them as normal links or malicious links.

[0017] Furthermore, the feature vectors output by the detection module are concatenated to form a fused feature vector to maintain the independence of the results of each detection module. The concatenated fused feature vector is then input into the classification module. The classification module can use the TabNet method to take tabular data, i.e., the fused feature vector, as input and take spam category, probability, or rating as output.

[0018] Furthermore, the processing module takes the spam category or score output by the classification module as input and processes specific spam categories in conjunction with default policies or customer-customized policies. The processing methods can be one or more of the following: blocking, alarm, reminder, and allowing. Alternatively, the processing policies can be dynamically modified based on the customer's behavior with the emails. It can also automatically unsubscribe from emails that can be unsubscribed from as needed. The policies in the processing module can be modified by the customer. Modifiable policies can include allowing or blocking commercial promotional emails and news notification emails.

[0019] Secondly, this solution provides a spam classification device. The device structure mainly includes an extraction module, a detection module, a classification module, and a disposal module, employing the spam classification method described above. The extraction module extracts target fields related to sender, recipient, CC, subject, body, and attachments from the email data, forming a field set. It also includes multimedia, hyperlinks, and the overall presentation of the email within the body or attachments. The detection module calls several detection sub-modules to detect the data extracted by the extraction module and outputs feature vector results. The detection sub-modules include a feature engineering detection module, an LLM detection module, a CV detection module, and a hyperlink detection module. The classification module concatenates the output feature vectors from each detection sub-module into an email fusion feature vector, classifies it according to deep learning classification methods such as TabNet, and generates scores for each type. The disposal module disposes of emails based on strategies and the email type or score generated by the classification module. Email disposal can be divided into different strategies: blocking, alerting, reminding, allowing, and unsubscribing. Furthermore, customers can modify the strategies in the disposal module to allow or block commercial promotional emails and news notification emails.

[0020] Thirdly, this solution provides an electronic device, including a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program to implement the steps of any of the aforementioned spam classification methods.

[0021] Fourthly, this solution provides a computer-readable storage medium storing a computer program, which, when executed by a processor, is used to implement the steps of any of the aforementioned spam classification methods.

[0022] This solution combines artificial intelligence and deep learning technologies to further segment spam emails, not only improving the accuracy of spam detection but also providing more personalized settings. This allows users to better manage email classification rules, reduce false positives, and ensure that valuable emails are not misclassified. This system will optimize the customization of spam detection by combining more granular email classification with user behavior and interests, thereby enhancing the overall user experience.

[0023] This solution allows clients to handle different categories of spam differently. It overcomes the problem of previous patents that uniformly processed spam without further categorization and processing. For example, previous patents divided emails into spam (A) and legitimate emails (B), treating A emails uniformly. This patent, however, further categorizes spam (A) into A1 subscription emails, A2 advertising emails, A3 news emails, etc., and processes each of these categories individually. This prevents users from wanting to see A1 emails but not A2 or A3 emails.

[0024] Technical effect

[0025] The following will further explain the concept, specific structure, and technical effects of the present invention in conjunction with the accompanying drawings, so as to fully understand the purpose, features, and effects of the present invention. Attached Figure Description

[0026] Figure 1 This is an overall flowchart of a spam classification method according to a preferred embodiment of the present invention;

[0027] Figure 2 This is a flowchart illustrating a preferred embodiment of the spam classification method of the present invention.

[0028] Figure 3 This is a structural diagram of a spam sorting device according to a preferred embodiment of the present invention;

[0029] Figure 4 This is a structural diagram of an electronic device for classifying spam emails according to a preferred embodiment of the present invention. Detailed Implementation

[0030] The following description, with reference to the accompanying drawings, illustrates several preferred embodiments of the present invention to make its technical content clearer and easier to understand. The present invention can be embodied in many different forms, and the scope of protection of the present invention is not limited to the embodiments mentioned herein.

[0031] In the accompanying drawings, components with the same structure are indicated by the same numerical designation, and components with similar structures or functions are indicated by similar numerical designations. The dimensions and thicknesses of each component shown in the drawings are arbitrary, and the present invention does not limit the dimensions and thicknesses of each component. To make the illustrations clearer, the thickness of some components has been appropriately exaggerated in the drawings.

[0032] like Figure 1 As shown, Embodiment 1, as a preferred embodiment of this application, implements a method for classifying spam emails, mainly including:

[0033] S101: Extract email data. Extract target fields related to sender, recipient, CC, subject, body, and attachments from the email data to form a field set. Also includes multimedia, hyperlinks, and overall email presentation that may exist in the body or attachments.

[0034] S102: This module performs multi-dimensional email inspection, calling various inspection sub-modules to inspect the data extracted by the extraction module and outputting feature vector results. The inspection sub-modules include a feature engineering inspection module, an LLM inspection module, a CV inspection module, and a hyperlink inspection module.

[0035] S103: Classify based on fused features. Classify the emails according to the unsupervised classification method based on the email feature vectors and generate scores for each type.

[0036] S104: Email processing. Emails are processed according to the strategy and the email type and score generated by the classification module. Email processing can be divided into different strategies such as blocking, alarm, reminder, allowing, and unsubscribing.

[0037] The extraction module is responsible for extracting relevant target information from the email server. It extracts target fields related to sender, recipient, CC, subject, body, and attachments from the email data to form a field set. It also includes multimedia, hyperlinks, and overall email presentation that may exist in the body or attachments.

[0038] The "presentational effect" refers to the overall visual effect of the email from the recipient's perspective. Since spam emails are often advertisements or notifications, they typically use a fixed format to attract attention. Compared to legitimate emails, they are easier for a human to judge from a human perspective. The "presentational effect" of the email refers to using a CV (CV detection) module to simulate human observation and determine whether an email is spam.

[0039] The feature engineering detection module extracts email metadata (such as From, MailFrom, To, CC / BCC, Subject, Reply-To, Message-ID, etc.) and converts it to an appropriate format. Then, it uses a Convolutional Neural Network (CNN) or a Recurrent Neural Network (RNN) for spam classification. First, the metadata undergoes preprocessing and feature engineering, such as field normalization and creating combined features. Next, the processed data is fed into the model; CNNs can capture local features, while RNNs can identify long dependencies in sequences. Finally, the model is trained to distinguish between spam and legitimate emails, thus achieving effective spam detection.

[0040] The LLM detection module takes all data from the entire email, including sender, recipient, CC, subject, body, and attachments, as input for unified detection and outputs a feature vector of the entire email. This module converts the entire email data into tokens, and the pre-training task is to replace ELECTRA with random words.

[0041] The main advantage of using ELECTRA in the LLM detection module in this embodiment is its higher training efficiency, avoiding the waste of mask word data by utilizing the replacement word detection task, and its smaller parameter size and lower computational resource requirements. In downstream tasks, ELECTRA achieves performance equal to or even surpasses BERT at a lower cost, making it very suitable for practical industrial deployments and resource-constrained scenarios.

[0042] The CV detection module performs computer vision color detection, primarily analyzing the images contained in the entire email and the overall presentation of the email. The extraction module extracts images from the email and extracts the email's visual presentation, i.e., its visual impact on humans. The CV module can use pre-trained CNNs, ResNets, Inception, VGG, etc., to extract image features, thereby using computer vision technology to detect images and the overall presentation of the email, thus identifying spam and performing further classification.

[0043] Optionally, the hyperlink detection module can detect hyperlinks in the email body or identifiable attachments. The extraction module extracts features from the links (such as character length, proportion of special characters, common subdomains, etc.) and inputs them into the hyperlink detection module. The hyperlink detection module will use a trained model to classify the links (normal links or malicious links).

[0044] Furthermore, the feature vectors output by the detection modules described above are concatenated to form a fused feature vector, maintaining the independence of the results from each detection module. This concatenated fused feature vector is then input into the classification module. The fused feature vector highlights features that significantly impact the classification task, improving the model's interpretability and classification accuracy. The classification module can use the TabNet method with tabular data (i.e., the fused feature vector) as input and further outputs such as spam category and probability, or a rating. This method combines the advantages of decision trees and neural network models, and improves the ability to learn features by using a sequential attention mechanism at each decision step to select features for inference.

[0045] The fusion feature vector processing method adopted in this embodiment proposes a new email representation framework, which introduces a common feature fusion module for emails during the pre-training process. This significantly improves the pre-trained model's ability to represent traffic features, enhances its accuracy in classification tasks, and strengthens the model's interpretability.

[0046] Furthermore, the processing module takes the spam category and score output by the classification module as input and combines default or customized strategies to process specific spam categories, such as blocking, alerting, reminding, and allowing. It can also automatically unsubscribe from emails that can be unsubscribed from. In addition, customers can modify the strategies in the processing module, such as allowing or blocking certain commercial promotional emails and news notifications, to achieve more granular email classification and a combination of user behavior and interests, optimizing the customization of spam detection and thus improving the overall user experience.

[0047] like Figure 2 As shown, as a specific embodiment, the spam detection method provided in Embodiment 1 of this application, based on the above content, further includes the following in the detection process of each detection module:

[0048] Each detection model can be integrated with various blacklist and whitelist databases. For example, the hyperlink detection module can compare the hyperlinks with known malicious website blacklists, or use open-source blacklists or third-party services (such as Google Safe Browsing API, PhishTank, etc.) to check the safety of the links. The feature engineering module can use email blacklists and whitelists to compare sender information for rapid detection.

[0049] like Figure 2 As shown in the illustration, as a specific embodiment, the spam handling method provided in Embodiment 1 of this application, based on the above content, further includes:

[0050] The handling module can adjust its handling strategy based on real-time feedback from users on the duration of reading specific emails and the frequency of clicks. It can further relax security checks and adjust scoring strategies for spam categories that users are interested in, so as to achieve dynamic spam security detection and handling.

[0051] See Figure 3 As shown, Embodiment 2, as another preferred embodiment of this application, discloses a spam sorting device, mainly comprising:

[0052] The extraction module 301 is used to extract target fields related to sender, recipient, CC, subject, body, and attachments from email data to form a field set. It also includes multimedia, hyperlinks, and overall email presentation effects that may exist in the body or attachments.

[0053] The detection module 302 calls various detection sub-modules to detect the data extracted by the extraction module and outputs feature vector results. The detection sub-modules include a feature engineering detection module, an LLM detection module, a CV detection module, and a hyperlink detection module.

[0054] The classification module 303 concatenates the output feature vectors of each detection submodule into an email fusion feature vector, classifies it according to deep learning classification methods such as TabNet, and generates ratings for each type.

[0055] The processing module 304 processes emails based on the aforementioned strategy and the email type and score generated by the classification module. Email processing can be categorized into different strategies such as blocking, alerting, reminding, allowing, and unsubscribing. Furthermore, customers can modify the strategies in the processing module, such as allowing or blocking certain commercial promotional emails or news notification emails, to achieve more refined email classification and a combination of user behavior and interests, optimizing the customization of spam detection and thus improving the overall user experience.

[0056] As can be seen, the spam classification device disclosed in this application utilizes multiple detection sub-modules and a classification module to perform detailed classification of spam emails. The disposal module selects the disposal action for spam emails based on the classification results, thereby effectively improving the accuracy of spam email detection and greatly enhancing the security, convenience, and value of email usage.

[0057] For details regarding the aforementioned spam sorting device, please refer to the detailed introduction of spam sorting methods mentioned above, which will not be repeated here.

[0058] As a specific embodiment, the spam classification device implemented in Embodiment 2 of this application, based on the above content, has an extraction module 301 that extracts relevant information from the email data, specifically used for:

[0059] Extract target fields from email data related to sender, recipient, CC, subject, body, and attachments to form a field set. Also included are multimedia, hyperlinks, and overall email presentation that may exist in the body or attachments.

[0060] The performance of the email refers to the ability of the CV detection module to simulate human observation and determine whether the email is spam.

[0061] As a specific embodiment, the spam sorting device disclosed in Embodiment 2 of this application, based on the above content, further includes:

[0062] The detection module includes a feature engineering detection module, an LLM detection module, a CV detection module, and a hyperlink detection module. These modules respectively detect structured data such as sender, recipient, CC, and hyperlinks; detect the entire email data; detect the images contained in the entire email and the overall presentation of the email; and detect hyperlinks in the email body or attachments.

[0063] As a specific embodiment, the spam classification device disclosed in Embodiment 2 of this application, based on the above content, specifically uses module 302 to call various detection modules for processing when it calls them to:

[0064] The feature engineering detection module can extract email metadata (such as From, MailFrom, To, CC / BCC, Subject, Reply-To, Message-ID, etc.) and convert it into an appropriate format, and then use a convolutional neural network (CNN) or a recurrent neural network (RNN) to classify spam.

[0065] The LLM detection module takes all data from the entire email, including sender, recipient, CC, subject, body, and attachments, as input for unified detection and outputs the feature vector of the entire email.

[0066] The CV detection module implements computer vision color detection, and its main detection object is the visual analysis of the images contained in the entire email and the overall presentation of the email.

[0067] The hyperlink detection module can detect hyperlinks in the email body or identifiable attachments, and the extraction module extracts features from the links.

[0068] As a specific embodiment, the spam classification device disclosed in Embodiment 2 of this application, based on the above content, calls the classification module 303 to concatenate the feature vectors generated by each detection module to form a fused feature vector, specifically used for:

[0069] Based on the email feature vectors, the emails are classified using an unsupervised classification method, and a score is generated for each type.

[0070] As a specific embodiment, the spam classification device disclosed in Embodiment 2 of this application, based on the above content, calls the processing module 304 to further process the various spam types and scores generated by the classification module, specifically for:

[0071] Emails are processed based on the strategy and the email type and score generated by the classification module. Email processing can be divided into different strategies such as blocking, alerting, reminding, allowing, and unsubscribing.

[0072] See Figure 4 As shown, Embodiment 3, as another preferred embodiment of this application, discloses an electronic device, including:

[0073] Memory 401 is used to store computer programs;

[0074] Processor 402 is configured to execute the computer program to implement the steps of any of the spam classification methods described above.

[0075] Furthermore, in another preferred embodiment of this application, Embodiment 4 discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, is used to implement the steps of any of the spam classification methods described above.

[0076] For details regarding the aforementioned electronic devices and computer-readable storage media, please refer to the detailed introduction of spam classification methods mentioned above; further details will not be repeated here.

[0077] The various embodiments in this application are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0078] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method of classifying spam, characterized by, The method comprises the steps of: extracting email data, detecting the email from multiple dimensions, classifying based on fusion features, and disposing the email. The extraction of email data is performed by an extraction module to extract each target field in the email data related to the sender, recipient, carbon copy, subject, body, and attachment to form a field set, and also includes multimedia, hyperlinks, and the presentation effect of the entire email that may exist in the body or attachment. The presentation effect of the email refers to the judgment of whether the email is a spam email by simulating the observation ability of a person through a CV detection module. Specifically, the visual presentation effect of the email refers to the presentation form and features of the email in the visual layer of a person, and the features include one or more of the layout, font and text features, image content, color matching and style, and brand features of the email. The detection of the email from multiple dimensions is performed by calling several detection sub-modules to detect the data extracted by the extraction module and output feature vector results. The detection sub-modules include one or more of the feature engineering detection module, LLM detection module, CV detection module, and hyperlink detection module. The classification based on fusion features is performed by a classification module to splice the feature vectors output by the several detection sub-modules to form a fusion feature vector that comprehensively considers multiple dimensions such as email metadata, semantic content, visual presentation, and link security. The fusion feature vector is classified according to an unsupervised classification method, and a score for each type is generated. The disposal of the email is performed according to the type and score of the email generated by the classification module and the disposal strategy. The email disposal is one or any combination of the blocking, alerting, reminding, releasing, and unsubscribing strategies.

2. The method of claim 1, wherein, The feature engineering detection module extracts the metadata of the email and converts it into a numerical or vector representation form that can be used for machine learning model processing and learning, and then uses a convolutional neural network or a recurrent neural network for spam email classification. The metadata can be one or more of From, MailFrom, To, CC / BCC, Subject, Reply-To, and Message-ID. The specific processing steps of the feature engineering detection module are as follows: first, pre-process and perform feature engineering on the metadata. The pre-processing can be standardization of the field, and the feature engineering can be creation of combined features. Then, input the processed data into the model. The model can use a convolutional neural network to capture local features, or a recurrent neural network to recognize long dependencies in numerical or vector sequences. Finally, train the model to distinguish between spam emails and normal emails, thereby achieving effective spam email judgment.

3. The method of claim 1, wherein the step of classifying the e-mail as spam or non-spam is performed by a neural network. The LLM detection module detects all data related to the sender, recipient, carbon copy, subject, body, and attachment of the entire email as input and outputs the feature vector of the entire email. The LLM detection module converts the data of the entire email into Token, and the pre-training task can replace the random word task with ELECTRA.

4. The method of claim 1, wherein, The CV detection module realizes computer vision color detection, and the detected object is the picture contained in the entire mail and the visual analysis of the performance effect of the entire mail; the extraction module extracts the picture in the mail and extracts the performance effect of the mail in the form of a picture, that is, the visual effect of the mail on a person, the CV detection module uses a pre-trained model to extract image features, and the pre-trained model can be one of CNN, ResNet, Inception, and VGG; the computer vision technology is used to detect the image in the mail and the performance effect of the mail, so as to identify the spam mail and further classify it.

5. The method of claim 1, wherein the step of classifying the e-mail as spam or non-spam is performed by a neural network. The hyperlink detection module detects the hyperlink in the mail body or the identifiable attachment, the extraction module extracts features from the link, the features extracted from the link include one or more of character length, special character ratio, and common subdomain name, and the features are input into the hyperlink detection module, the hyperlink detection module uses a trained model to classify, and the classification is normal link or malicious link.

6. The method of claim 1, wherein, The output feature vectors of the detection modules are spliced to form a fusion feature vector, so as to maintain the independence of the results of the respective detection modules, and the spliced fusion feature vector is input into the classification module, the classification module can use the TabNet method to use the tabular data, that is, the fusion feature vector as input, and use the spam mail category or possibility or score as output.

7. The method of claim 1, wherein, The disposal module takes the spam mail category or score output by the classification module as input, and combines a default strategy or a customer customized strategy to process a specific spam mail category, and the processing means is one or more of blocking, warning, reminding, and release strategy, or the above disposal strategy is dynamically modified according to the behavior of the customer to the mail; The mail that can be unsubscribed is automatically unsubscribed on demand; The strategy in the disposal module can be modified by the customer, and the modifiable strategy is to release or block the commercial promotion mail and the news notification mail.

8. A spam classification apparatus characterized by comprising: The method comprises an extraction module, a detection module, a classification module, and a disposal module, and any one of the classification methods of the spam mail in claims 1-7 is adopted; The extraction module is used to extract each target field related to the sender, the recipient, the carbon copy, the subject, the body, and the attachment in the mail data to form a field set, and also includes multimedia, hyperlinks, and the performance effect of the entire mail that may exist in the body or the attachment; The detection module calls a plurality of detection sub-modules to detect the data extracted by the extraction module and outputs a feature vector result; The detection sub-modules include a feature engineering detection module, an LLM detection module, a CV detection module, and a hyperlink detection module; The classification module splices the output feature vectors of the plurality of detection sub-modules into a mail fusion feature vector, classifies according to the TabNet deep learning classification method, and generates a score number of each type. The disposal module disposes the mail according to the policy and the mail type or score generated by the classification module, and the mail disposal can be divided into: blocking, alarming, reminding, releasing, canceling subscription of different policies; in addition, the customer can modify the policy in the disposal module, and implement release or block for commercial promotion mail and news notification mail.

9. An electronic device comprising a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program to realize the steps of any one of the spam classification methods of claims 1-7.

10. A computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by a processor to realize the steps of any one of the spam classification methods of claims 1-7.

Images