Method for identifying harmful information in short message content based on big data

Abstract

The invention discloses a method for identifying harmful information in short message content based on big data, and relates to the technical field of data management.The method for identifying the harmful information in the short message content comprises the steps that multiple kinds of harmful short message historical samples are collected to construct a harmful information sample set containing different languages and types; the recognition capability of the model on multilingual harmful information is improved; short message data are input to the recognition model in real time, potential harmful information can be detected in time, manual intervention is reduced, and the processing efficiency is improved; the first module screens out suspicious short messages through quick scanning, marks potential risk data and ensures efficient concentration of subsequent analysis; the second module improves the recognition accuracy by deeply analyzing character features; sending characteristics are analyzed through a third module, high-risk users can be identified, targeted precautionary measures are formulated, and safety monitoring is dynamically adjusted; therefore, harmful information diffusion is effectively reduced, and communication environment safety is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of data management, and in particular to a method for identifying harmful information in text message content based on big data. Background Art

[0002] With the development and improvement of wireless communication services, SMS services provide users with convenient information while also providing a channel for the spread of harmful information. Especially for minors, facing the intimidation or harassment of harmful information will cause psychological trauma. The traditional method of identifying harmful information in SMS content is limited to judging whether it is harmful by the literal meaning of the SMS text, which makes it difficult to accurately identify and effectively control the spread of harmful garbage.

[0003] To sum up, how to accurately identify and effectively control harmful information is an issue that needs to be urgently solved and optimized in the method of identifying harmful information in text message content based on big data. Summary of the invention

[0004] The present invention provides a method for identifying harmful information in text message content based on big data, which solves the technical problem of how to accurately identify and effectively control harmful information.

[0005] In order to solve the above technical problems, the present invention provides a method for identifying harmful information in SMS content based on big data. The specific technical solution is as follows:

[0006] A method for identifying harmful information in text message content based on big data, comprising the following steps:

[0007] S100, collecting multiple harmful information SMS history samples to obtain a harmful information history sample set; compiling harmful information keywords in the sample set into multiple language versions to train an information recognition model, and output harmful information feature recognition results; the information recognition model includes a first module, a second module and a third module;

[0008] S200, inputting the SMS data sent by the sending end in real time into the information recognition model; the first module receives the SMS data and scans and reads it to output initial harmful information suspicious SMS data;

[0009] S300, transmitting the SMS data identified by the first module to the second module, the second module identifying the suspicious harmful information character features in the initial suspicious harmful information data, and obtaining the meaning of the suspicious characters to output secondary suspicious harmful information SMS data;

[0010] S400, inputting the SMS data identified by the second module into the third module, the third module traces the IP address of the SMS data sender to obtain the source tracing information of the SMS data sender, and outputs the final identification result of the suspicious SMS data of harmful information according to the source tracing information; when the SMS data containing harmful information is identified, executing step S500;

[0011] S500, performing sending characteristic analysis on the SMS data containing harmful information to obtain harmful information sending rule characteristic data; obtaining currently defined label data of the user number based on the harmful information sending rule characteristic data, and updating the currently defined label of the user number to obtain a safe user number.

[0012] As a further optimization scheme of the present invention, a plurality of harmful information SMS history samples are collected to obtain a harmful information history sample set; the harmful information history sample set is compiled into multiple language versions to train an information recognition model to output harmful information feature recognition results; the information recognition model comprises a first module, a second module and a third module, including:

[0013] Collect historical sample data of various SMS sources containing harmful information, including fraudulent SMS, horrific and bloody SMS, pornographic and obscene SMS, and virus links;

[0014] Based on the historical sample data, keywords containing harmful information in the historical sample data are converted into multiple target language versions; and multiple target language versions of multiple keywords are semantically verified to obtain an accurate translation data set;

[0015] The accurate translation dataset is obtained by: i ={wSim(k i ,w)>α} to obtain similar words of multiple keywords; where w represents the feature parameter of similar words; K i represents a keyword; α represents a similarity threshold; based on the obtained similar words of the multiple keywords, by: To obtain a keyword similar semantic expansion set; and combine the keyword similar semantic expansion set with the keyword K i Fusion is a comprehensive sample set; where, represents the final multilingual similar keyword expansion set; m represents the number of similar keywords; represents the expansion function;

[0016] The comprehensive sample set is constructed into a training set: G = {n1, n2, ..., n i}; where n i Represents the i-th accurate translation data item; the training set G is input into the information recognition model for training to output the harmful information feature recognition result.

[0017] As a further optimization scheme of the present invention, the SMS data sent by the sending end in real time is input into the information recognition model; the first module receives the SMS data for scanning and reading to output initial harmful information suspicious SMS data, including:

[0018] The newly sent SMS data is input into the information recognition model, and the first module extracts SMS data with similar format templates that are repeated multiple times to obtain similar template text data;

[0019] The similar template text data D is pre-screened by setting a format similarity rule set {R i} n i =1; by traversing each template text T in the SMS data j ; For each T j The template text data is formatted and analyzed to obtain the template text data format rule R i The matching situation; if T j Does not meet R i If the format rule is met, it will be retained in the template text data with different formats, otherwise it will be discarded; in order to filter out the template text data with unified format; the template text data with unified format is the initial harmful information suspicious data.

[0020] As a further optimization scheme of the present invention, the SMS data identified by the first module is transmitted to the second module, and the second module identifies the suspicious character features of harmful information in the initial suspicious harmful information data, and obtains the meaning of the suspicious characters to output secondary suspicious harmful information SMS data, including:

[0021] Further reading SMS text characters from the template text data of different formats to obtain a suspicious character feature data set in the text; the suspicious character feature data includes misleading words in multiple languages;

[0022] Identify and annotate each suspicious character feature data to obtain a corresponding category data set; the corresponding category data set includes annotating multilingual words into fraud, violence and blood, pornography and filth, and terror;

[0023] Based on the suspicious character feature data set, the template text data of different formats are parsed according to the context, by: To judge the meaning of the character data item of the character feature data set is suspicious, where F(t i ) indicates the final parsed meaning of the character data item; t i Indicates the meaning of the i-th template text fragment; C(t i ) represents the template fragment t iThe inference parameter of ; T represents the corresponding category data set; Indicates inference symbol;

[0024] Based on the obtained judgment results, through: To obtain the frequency of suspicious characters, where fi represents the frequency of suspicious characters in SMS data; C represents the number of times suspicious characters appear; W represents the total number of characters in SMS data; and the SMS data with suspicious characters is subjected to secondary screening to obtain secondary harmful information suspicious data.

[0025] As a further optimization scheme of the present invention, each suspicious character feature data is identified and annotated to obtain a corresponding category data set; the corresponding category data set includes annotating multilingual words into fraud, violence and blood, pornography and filth, and terror, including:

[0026] Based on the corresponding category data set, suspicious words in the text message are captured, and the suspicious words in the text message data are matched with the corresponding category data set to obtain a matching data set; based on the matching data set, a sensitive word library for minors is established;

[0027] Based on the sensitive word library for minors, sensitive words or inappropriate words in the sensitive word library for minors are replaced with latent pronouns that are safe and suitable for minors to obtain a latent pronoun dataset;

[0028] By comparing the suspicious words in the SMS data with the subtitle pronoun data set and judging the suspiciousness of the subtitle pronouns, the harmful risk of the suspicious subtitle pronouns is analyzed to obtain risk SMS information;

[0029] The risk SMS information is tested for similarity with sensitive words in a sensitive word library for minors to determine whether the potential pronouns in the SMS data are harmful information data.

[0030] As a further optimization scheme of the present invention, similarity detection is performed between the risk SMS information and sensitive words in the sensitive word library for minors to determine that the suspicious words in the SMS data are harmful information data, including:

[0031] According to the similarity detection, the matching degree of the minor sensitive words is obtained; based on the matching degree, the risk SMS information is further fuzzy matched and analyzed to obtain accurate matching data;

[0032] Based on accurate matching data, the potential pronouns in the SMS data are determined to be harmful information data, and an information feedback channel is set up;

[0033] Based on the feedback channel, inappropriate information is fed back in a timely manner and the feedback information is automatically categorized and prioritized to update the sensitive word library for minors to obtain feedback results.

[0034] As a further optimization scheme of the present invention, the SMS data identified by the second module is input into the third module, and the third module traces the IP address of the SMS data sender to obtain the source tracing information of the SMS data sender, and outputs the final harmful information suspicious SMS data identification result according to the source tracing information, including:

[0035] Tracing back the IP address based on metadata sent by the SMS data; the metadata includes the first eight digits of the sending number, the HTTP request header, and the domain name registration information of the SMS link;

[0036] Based on the metadata, the IP address of the SMS data is obtained. When the SMS IP address is an overseas address, the suspicious degree of harmful information is high; and further judgment is made in combination with the text information of the SMS data; when the text information identifies words related to money and personal safety, a warning message is promptly sent to the user number of the receiving end; so as to identify the suspicious SMS data of harmful information.

[0037] As a further optimization scheme of the present invention, the sending characteristics of the SMS data containing harmful information are analyzed to obtain harmful information sending rule characteristic data; based on the harmful information sending rule characteristic data, the current defined label data of the user number is obtained, and the current defined label of the user number is updated to obtain a safe user number, including:

[0038] Collect statistics on the sending time, sending user information and sending content of SMS data containing harmful information to obtain the sending characteristic data of harmful information;

[0039] Based on the harmful information sending characteristic data, the user number that frequently receives harmful information is analyzed for usage behavior, wherein the user number usage behavior includes browsing, reading, sending and receiving SMS data; to obtain usage behavior security analysis data;

[0040] Based on the usage behavior security analysis data, harmful information sending rule characteristic data is obtained; according to the harmful information sending rule characteristic data, the user number currently defined label data is obtained; the user number currently defined label data is updated to obtain a safe user number.

[0041] As a further optimization scheme of the present invention, according to the harmful information sending rule characteristic data, to obtain the current defined label data of the user number, including:

[0042] According to the usage behavior security analysis data, through: To obtain the abnormal degree of user number usage; where D u Indicates the abnormal degree of user number usage; f urepresents the frequency of harmful information received by the user, that is, the number of harmful text messages received within the time window H; μ represents the average frequency of harmful information received by all users; σ represents the standard deviation of the frequency of harmful information received by all users;

[0043] Set the preset threshold range and set the abnormal degree of user number usage D u Compare with the preset threshold range, and judge whether the user number usage behavior is normal or abnormal based on the comparison result;

[0044] According to the usage behavior of the user number, a label is defined for the user number to obtain the currently defined label data of the user number; the currently defined label data of the user number includes two labels, normal and abnormal.

[0045] As a further optimization solution of the present invention, the currently defined tag data of the user number is updated to obtain a safe user number, including:

[0046] Based on the currently defined tag data of the user number, the login information, purchase behavior, browsing history or interaction history of the system platform used by the user number is obtained to obtain a tag source data set;

[0047] Based on the label source data set, provide the user with a prompt for selective label cleaning, so that the user can clean and update the current defined label data to obtain an initialized defined label;

[0048] Based on the initialization, a tag is defined to make the current user number a safety number.

[0049] The present invention has at least the following beneficial effects: by collecting multiple historical samples of harmful information SMS messages, the present invention can construct a harmful information sample set containing different types and language versions. This process helps the model learn harmful information patterns in different languages ​​and cultural backgrounds, thereby improving the accuracy and wide applicability of the model; keyword recognition ability is enhanced: by compiling harmful information keywords in the sample set into multiple language versions, the model's ability to identify harmful information can be enhanced, ensuring that it can identify harmful content in multiple languages ​​and improving cross-language protection effects.

[0050] By inputting SMS data into the information recognition model in real time, potential harmful information can be detected in a timely manner, ensuring that a response can be made in the shortest possible time to avoid the spread of harmful information; automatically inputting SMS data into the information recognition model can reduce manual intervention and improve processing efficiency.

[0051] Through the scanning of the first module, potentially harmful text messages can be quickly screened out and preliminary suspicious data can be marked. This step improves the system's sensitivity to harmful information, allowing subsequent analysis to focus more on potential risks; the work of the first module can quickly identify and mark suspicious data in massive data, ensuring that subsequent processing is more efficient.

[0052] The second module is not just a simple text scan, but also further analyzes the character features in the text message to dig deeper into potentially harmful information. This multi-level recognition method greatly enhances the accuracy of detection; by identifying the meaning of suspicious characters and deeply analyzing their potential risks, it helps to accurately identify real harmful information, reduce false alarms, and improve the credibility of recognition.

[0053] By analyzing the characteristics of harmful information transmission, the behavior pattern of the sender can be identified, and "rules for sending harmful information" can be further established. Based on these characteristics, more targeted preventive measures can be taken to pay special attention to and manage high-risk users; by updating the labels of user numbers, security monitoring measures for users can be dynamically adjusted. For example, if a user frequently sends harmful information, he or she can be marked as a high-risk user, so that his or her behavior will be more strictly reviewed in the future; based on the transmission characteristics and label updates, the risk of malicious information spreading can be effectively reduced, ensuring the security of the user's communication environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flowchart of a method for identifying harmful information in text message content based on big data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The present application is further described in detail below in conjunction with the accompanying drawings. It is necessary to point out here that the following specific implementation methods are only used to further illustrate the present application and cannot be understood as limiting the scope of protection of the present application. Technical personnel in this field can make some non-essential improvements and adjustments to the present application based on the above application content.

[0056] This embodiment provides a method for identifying harmful information in text message content based on big data, and the specific implementation method is as follows:

[0057] like Figure 1 As shown, a method for identifying harmful information in text message content based on big data includes the following steps:

[0058] S100, collecting multiple harmful information SMS history samples to obtain a harmful information history sample set; compiling harmful information keywords in the sample set into multiple language versions to train an information recognition model, and output harmful information feature recognition results; the information recognition model includes a first module, a second module and a third module;

[0059] S200, inputting the SMS data sent by the sending end in real time into the information recognition model; the first module receives the SMS data and scans and reads it to output initial harmful information suspicious SMS data;

[0060] S300, transmitting the SMS data identified by the first module to the second module, the second module identifying the suspicious harmful information character features in the initial suspicious harmful information data, and obtaining the meaning of the suspicious characters to output secondary suspicious harmful information SMS data;

[0061] S400, inputting the SMS data identified by the second module into the third module, the third module traces the IP address of the SMS data sender to obtain the source tracing information of the SMS data sender, and outputs the final identification result of the suspicious SMS data of harmful information according to the source tracing information; when the SMS data containing harmful information is identified, executing step S500;

[0062] S500, performing sending characteristic analysis on the SMS data containing harmful information to obtain harmful information sending rule characteristic data; obtaining currently defined label data of the user number based on the harmful information sending rule characteristic data, and updating the currently defined label of the user number to obtain a safe user number.

[0063] In this embodiment, harmful SMS samples of multiple languages ​​and types are collected through step S100 to establish a harmful information sample set containing historical data. Then, the harmful information keywords in these samples are compiled into multilingual versions to build a cross-language information recognition model. The model contains three modules, which are responsible for harmful information recognition at different levels; through the construction of a multilingual sample library and keyword compilation, the model can identify harmful information in a multilingual environment, enhance the ability to identify cross-cultural and multilingual harmful content, help reduce false positives, and improve the wide applicability and accuracy of the model.

[0064] Based on step S100, the SMS data of the sender is input into the information recognition model in real time through step S200. The first module scans the SMS data, extracts and marks the suspicious information that is initially identified, and provides preliminary screening data for the analysis of subsequent modules; the screening of the first module can quickly process a large amount of SMS data, reduce the interference of redundant information, filter and mark the suspected harmful information, provide clear data for further analysis, and effectively improve the processing efficiency.

[0065] In S300, the data screened by the first module is transmitted to the second module to further identify the harmful character features and meanings in the initial screening data, thereby outputting more in-depth suspicious SMS information; through in-depth analysis at the character level, the second module can identify more hidden harmful information features, further improve the recognition accuracy, reduce false alarms, and enhance the detection credibility of the model.

[0066] The data identified by the second module in step S400 is transmitted to the third module, and the IP address of the SMS sender is traced to obtain relevant tracing information to confirm the authenticity and risk of the sending source, and finally generate a comprehensive harmful information identification result; through tracing analysis, the third module can track and mark high-risk sending sources, which helps prevent the further spread of malicious information and improve overall information security.

[0067] S500 analyzes the sending characteristics of SMS data containing harmful information to establish and update "harmful information sending rule characteristic data". Based on the characteristic data, the user number label is updated to a dynamic security label to ensure accurate labeling of high-risk users; by analyzing and updating user labels, user behavior can be dynamically monitored, with special attention paid to users who frequently send harmful information. This mechanism effectively reduces the risk of malicious information spreading and provides continuous security protection for the overall communication environment.

[0068] Through the coordinated work of the above steps, real-time text messages can be detected quickly, malicious information can be identified in time, and potential harm (such as fraudulent information or spam text messages) can be prevented from spreading; the multi-module recognition method (from preliminary scanning to deep analysis, and then to source tracking) greatly improves the accuracy of recognition, and can refine the various characteristics of malicious information and reduce the false alarm rate; through multi-language support and real-time updating of user tags, it can cope with different language environments and changing malicious information trends; not only can it identify information, but it can also monitor and mark potential malicious users, helping operators or service platforms to track user behavior, intervene in time and protect ordinary users from malicious text messages.

[0069] In a preferred embodiment of the present invention, step S100 may further include the following steps:

[0070] Step S101, collecting various types of SMS source historical sample data containing harmful information, wherein the historical sample data includes fraudulent SMS, horror and bloody SMS, pornographic and obscene SMS, and virus links;

[0071] Step S102, based on the historical sample data, converting the keywords containing harmful information in the historical sample data into multiple target language versions; and performing semantic verification on the multiple target language versions of multiple keywords to obtain an accurate translation data set;

[0072] Step S103, the accurate translation data set is obtained by: i ={wSim(k i ,w)>α} to obtain similar words of multiple keywords; where w represents the feature parameter of similar words; K i represents a keyword; α represents a similarity threshold; based on the obtained similar words of the multiple keywords, by: To obtain a keyword similar semantic expansion set; and combine the keyword similar semantic expansion set with the keyword K i Fusion is a comprehensive sample set; where, represents the final multilingual similar keyword expansion set; m represents the number of similar keywords; represents the expansion function;

[0073] Step S104, construct the comprehensive sample set into a training set: G = {n1, n2, ..., n i}; where n i Represents the i-th accurate translation data item; the training set G is input into the information recognition model for training to output the harmful information feature recognition result.

[0074] In the embodiment of the present invention, the purpose of collecting historical sample data in step S101 is to collect representative types of harmful information text messages, such as fraud, horror, blood, pornography, and virus links. These sample data provide keywords, phrases, and content patterns for subsequent processing; historical sample data provide a rich corpus for model training, ensuring that the model can cover a variety of harmful information types and improve the accuracy of identifying similar information.

[0075] The harmful keywords extracted from the historical sample data in step S102 will be translated into multiple target languages ​​to ensure that the translations in different languages ​​retain the original meaning and eliminate ambiguity in the language translation process. This step will generate an accurate multilingual keyword translation data set; through multilingual keyword expansion and verification, the model's understanding of multilingual information is enhanced, ensuring the accuracy of keyword translation, which is helpful for identifying harmful information in a multilingual environment.

[0076] Step S103 fuses the keywords with the semantic extension set of similar words to generate a comprehensive sample set containing multiple semantic variants, thereby improving the model's recognition flexibility for the same type of information by expanding the synonyms, related words and multiple semantic variants of the keywords. Even if harmful information is expressed in different ways, the model can still recognize it.

[0077] In step S104, the comprehensive sample set is constructed into a training set G, and the training set is input into the information recognition model. By training multi-language and extended semantic samples, the model can recognize harmful information in various languages ​​and expressions; specifically, it includes:

[0078] The training set G is encoded into sequence data, and the sequence data is input into the information recognition model; the information recognition model includes an input layer, a first hidden layer, a second hidden layer, a third hidden layer and an output layer, and the intermediate representation data of each hidden layer is transmitted to the output layer, and the output of the output layer represents the recognition result of harmful information features of historical samples, which is as follows:

[0079] u (t) =σ(W u x (t) +W u H (t-1) +b u )

[0080] r (t) =σ(W r x (t) +W r H (t-1) +b r )

[0081] c (t) =tanh(W c x (t) +W c r (t) ·H (t-1) +b c )

[0082] H (t) =(1-u (t) )·c (t) +u (t) ·H (t-1)

[0083] Where W u , W r , W c represents the weight parameter, b u , b r , b c represents the bias parameter, represents the dot product, and u (t) 、r (t) and c (t) Represent the intermediate states of the first, second, and third hidden layers respectively, X (t) represents the tth data item of the comprehensive sample set, H (t) and H (t-1) They represent the intermediate representation data of the t-th and t-1-th comprehensive sample sets, respectively. n≥t≥1, where n represents the total number of input comprehensive sample set data items. When t=1, H (t-1) =X (t) , tanh is the hyperbolic tangent function, σ represents the sigmoid function;

[0084] Based on the recognition result of harmful information of the comprehensive sample set described in the history by the output layer, the intermediate representation data of the recognition result of the comprehensive sample set described in the history is output;

[0085] In this embodiment, each data item X(t) in the comprehensive sample set is input into the information recognition model. These data items may be arranged in chronological order, as mentioned in the subsequent description. (t-1) , indicating that from the current data item X (t) Start pushing the data item forward by 1 time step; the temporal relationship of the sequence data is preserved, and the model can be learned and inferred through temporal information, which is suitable for time series data analysis tasks.

[0086] The model structure consists of an input layer, a hidden layer, and an output layer. When the input layer receives data X (t) ; The first hidden layer, the second hidden layer and the third hidden layer receive the output of the previous layer in turn, and each layer is passed through the weight W y and bias b y Weighted and biased, then an activation function (hyperbolic tangent function tanh) is applied to produce the intermediate state u (t) 、r (t) and c (t) The intermediate states are passed through multiple layers to gradually extract and express high-level features of the input data.

[0087] The output layer receives the output of the last hidden layer, calculates the weighted sum through weights and biases, and then applies the sigmo id function to output the recognition result; multiple hidden layers can learn the characteristics of different abstract levels of data and improve the expression ability and recognition accuracy of the model.

[0088] The intermediate state u of the last hidden layer (t) 、r (t) and c (t) It is transmitted to the output layer, the weighted sum is calculated through weights and biases, and the sigmoid function is applied to generate the recognition result; through the transmission of intermediate states, the model can map the learned complex features to the final recognition decision, thereby improving the accuracy and interpretability of the recognition results; the multi-layer hidden layer structure allows the model to extract and combine the complex features of the input data layer by layer, enhancing the expressive power of the model.

[0089] The model can process time series data by retaining the historical information sample set H (t-1) , effectively utilizing time correlation; through the sigmoid function processing of the output layer, the model can generate accurate recognition results and is suitable for multi-category recognition tasks.

[0090] In a preferred embodiment of the present invention, the above step S200 includes:

[0091] Step S201, inputting the newly sent SMS data into the information recognition model, the first module extracts SMS data with similar format templates that are repeated multiple times to obtain similar template text data;

[0092] Step S202, pre-screening the similar template text data D, by setting a format similarity rule set {R i} n i =1; by traversing each template text T in the SMS data j ; For each T j The template text data is formatted and analyzed to obtain the template text data format rule R i The matching situation; if T j Does not meet R i If the format rule is met, it will be retained in the template text data with different formats, otherwise it will be discarded; in order to filter out the template text data with unified format; the template text data with unified format is the initial harmful information suspicious data.

[0093] Specific description: The output layer:

[0094]

[0095] In the formula, y v represents the newly acquired feature representation of the SMS data sent by the sender in real time, k v represents the intermediate representation data of the vth unit of the data matrix, M represents the set of all units of the data matrix, and W y is the weight parameter, b y is the bias parameter, representing the sigmoid function.

[0096] In the embodiment of the present invention, new SMS data is input into the information recognition model through step S201. The model identifies whether there is harmful information by analyzing the content, format, keywords and other features of the SMS; the first module in the model is specifically used to detect and extract similar format templates that appear multiple times in the SMS. Through the template recognition algorithm, the system can identify SMS content with similar formats that appear repeatedly (such as the fixed format of fraudulent SMS, the standard format of junk advertisements, etc.).

[0097] For example, fraudulent text messages usually have a fixed format, such as "Dear customer, your account has been frozen, please click this link to restore it." This format will appear repeatedly in multiple text messages; Acquisition of similar template data: By analyzing the format of text message data, the system extracts these repeated and similarly formatted text messages to form a collection of "similar template text data"; by extracting text message data with similar templates, the model can quickly screen out texts with potential risks from a large number of text messages, avoiding the need to analyze all text message contents one by one.

[0098] Template matching can help the model quickly identify harmful information with a fixed format, especially for known fraud and spam patterns, which greatly improves the accuracy of recognition;

[0099] The extracted similar template data is further screened in step S202 to reduce the amount of calculation and the possibility of false positives in subsequent processing. The screening rules are defined by a preset format similarity rule set {Ri}, which are fixed format template patterns obtained after analyzing historical data. For example: format rule R i It can be "the text message starts with a certain keyword, contains a URL link, and ends with a specific word"; for each extracted text message template T j The system will match each SMS template with the format rule by traversing the rule set; format feature analysis will detect T j Whether it complies with specific rules. If the SMS template complies with a certain rule, it is considered to be a template with a unified format, otherwise it is considered to have a different format; SMS that complies with the format rules will be considered to be harmful information with a unified format (such as the standard format of fraudulent SMS). These SMS will be regarded as "initial harmful information suspicious data".

[0100] SMS messages that do not conform to the format rules will be screened out, which means that these SMS formats do not conform to the known harmful information templates and will not be marked as harmful information for the time being; through pre-screening, the system can accurately identify harmful information that conforms to the template according to the known format rules. SMS messages that conform to the format rules are likely to be harmful information, while those that do not conform to the rules are eliminated, reducing the possibility of misjudgment; it helps to narrow the scope of suspicious information to be processed and focus on high-risk SMS messages. In this way, subsequent in-depth analysis can focus on high-potential harmful information; by filtering out template texts with unified formats, it ensures that only those SMS messages that truly meet the characteristics of harmful information are further processed in the future, avoiding wasting computing resources on a large amount of irrelevant data.

[0101] In a preferred embodiment of the present invention, the above step S300 includes:

[0102] Step S301, further reading SMS text characters from the template text data of different formats to obtain a suspicious character feature data set in the text; the suspicious character feature data includes misleading words in multiple languages;

[0103] Step S302, identifying and labeling each suspicious character feature data to obtain a corresponding category data set; the corresponding category data set includes labeling multilingual words as fraud, violence and blood, pornography and filth, and terror;

[0104] Step S302, based on the suspicious character feature data set, the template text data of different formats is parsed according to the context, by: To judge the meaning of the character data item of the character feature data set is suspicious, where F(t i ) indicates the final parsed meaning of the character data item; t i Indicates the meaning of the i-th template text fragment; C(t i ) represents the template fragment t i The inference parameter of ; T represents the corresponding category data set; Indicates inference symbol;

[0105] Step S303, based on the obtained judgment result, by: To obtain the frequency of suspicious characters, where fi represents the frequency of suspicious characters in SMS data; C represents the number of times suspicious characters appear; W represents the total number of characters in SMS data; and the SMS data with suspicious characters is subjected to secondary screening to obtain secondary harmful information suspicious data.

[0106] In this embodiment,

[0107] In a preferred embodiment of the present invention, the above step S302 includes:

[0108] Step S3021, based on the corresponding category data set, the suspicious words in the text message are captured, and the suspicious words in the text message data are matched with the corresponding category data set to obtain a matching data set; based on the matching data set, a sensitive word library for minors is established;

[0109] Step S3022: based on the sensitive word library for minors, replace sensitive words or inappropriate words in the sensitive word library for minors with latent pronouns that are safe and suitable for minors, so as to obtain a latent pronoun data set;

[0110] Step S3023, by comparing the suspicious words in the SMS data with the latent pronoun data set and determining the suspiciousness of the latent pronouns, the harmful risk of the suspicious latent pronouns is analyzed to obtain risk SMS information;

[0111] Step S3024: perform similarity detection between the risky SMS information and sensitive words in a sensitive word library for minors to determine whether the latent pronouns in the SMS data are harmful information data.

[0112] In this embodiment, in step S301, the SMS text characters are read from the template text data with non-uniform formats, and the "suspicious character feature data set" in the text is identified and extracted. The "suspicious characters" here refer to words with misleading or malicious intent in multiple languages. By deeply analyzing the characteristics of these characters, the system can identify potential risk content; lay the foundation for subsequent risk identification, extract a character set with specific properties, and help improve the accuracy of classification and identification.

[0113] In step S302, the "suspicious character feature data set" obtained in step S301 is analyzed and identified one by one, and classified into different risk categories such as fraud, violence and blood, pornography and terrorism. This classification is based on the semantic features of the characters and the speculation of multilingual specific contexts; through clear labeling and classification, the system can more specifically identify potentially harmful information, which is convenient for further analysis and screening in subsequent steps.

[0114] Based on step S302, step S303 uses contextual semantic analysis to combine the information of different template fragments in the text to generate the complete meaning of the character features. Based on the analysis of the character feature data set, the meaning of various character data items is judged to determine whether certain characters are risky; through the context, each character data item is analyzed to determine whether it may be a risky character; for each template fragment, its semantics is inferred and the possibility is calculated; for data items with different categories of features, whether they meet certain categories of risk attributes is inferred through the annotated information; parsing the semantic relationships and features in the context helps to avoid misjudgment and improves the ability to identify complex risk content.

[0115] Step S304 calculates the frequency of suspicious characters in the text message based on the judgment result of step S303, and accurately locks the secondary harmful information based on the frequency of character appearance. Through this step, the system can focus on high-risk information, greatly improving the accuracy and efficiency of screening.

[0116] In a preferred embodiment of the present invention, the above step S3024 includes:

[0117] Step S30241, obtaining a matching degree of sensitive words for minors according to the similarity detection; based on the matching degree, further fuzzy matching analysis is performed on the risk SMS information to obtain accurate matching data;

[0118] Step S30242: based on the accurate matching data, determine that the latent pronouns in the SMS data are harmful information data, and set up an information feedback channel;

[0119] Step S30243: Based on the feedback channel, timely feedback of inappropriate information is provided and the feedback information is automatically classified and prioritized to update the sensitive word library for minors to obtain feedback results.

[0120] In this embodiment, step S3021 captures suspicious words in the SMS data based on the "corresponding category data set" defined in the previous step. Suspicious words refer to those words that may contain fraud, violence, pornography or inappropriate content. By matching with the corresponding category data set, the system compares the suspicious words with predefined categories (such as fraud, violence and blood, pornography and filth, etc.) to determine the category to which they belong; based on this matching result, the system further establishes a "sensitive word library for minors". The sensitive word library is a specific vocabulary collection for harmful information that minors may be exposed to, and is designed to filter and manage the information content that minors are exposed to; by accurately matching suspicious words with category data sets, the system can automatically identify and classify sensitive information related to minors; establishing a "sensitive word library for minors" is a preventive measure that can provide an important word resource library for subsequent processing steps, thereby better protecting the information security of minors.

[0121] Step S3022 replaces sensitive words or inappropriate words with "subjective pronouns" based on the sensitive word library for minors established in step S3021. These subjective pronouns refer to alternative words that have a certain degree of concealment but can convey the same or similar meaning in the context, specifically including: game recharge and consumption

[0122] "Recharge"! "Krypton Gold" can be replaced by "obtain props" or "obtain resources"

[0123] : can be replaced by "senior member", "VIP" or "special member"

[0124] Can be replaced by "exclusive function" or "exclusive function" "privilege":

[0125] 2. Virtual currency and gambling content

[0126] "Lottery": can be replaced by "lucky draw" or "random reward"

[0127] "Gambling" / "betting": can be replaced by "challenge" or "betting".

[0128] "Wheel": can be replaced by "Wheel of Fortune" or "Lucky Wheel".

[0129] 3. Social interaction in the game

[0130] "Team" / "Guild": can be replaced by "Team" or "Club"

[0131] "PK" / "Arena": can be replaced with "Battle" or "Friendly Battle"

[0132] 4. Violence, blood and bad culture

[0133] "Bloody" / "violent": can be replaced with "intense" or "tense"

[0134] "Hunting" / "Killing": can be replaced by "Challenge" or "Adventure"

[0135] "Evil": can be replaced by "opponent" or "hostile force"

[0136] 5. Advertising slogan introduction

[0137] "Buy Now": can be replaced by "Get" or "Unlock"

[0138] "Limited time offer": can be replaced by "Special event" or "Limited time event",

[0139] 6. Game duration and reminders

[0140] "Addiction": can be replaced by "focus" or "investment" "Excessive gaming": can be replaced by "reasonable gaming" or "healthy gaming"

[0141] 7. Personal attacks, vulgar and unhealthy content

[0142] "Stupid": can be replaced by "not very smart" or "irrational"

[0143] "Waste": can be replaced by "needs improvement" or "needs improvement"

[0144] 8. Identification of Minors

[0145] "Minors": can remain unchanged, but ensure privacy and security settings

[0146] 9. Internet addiction and misleading content

[0147] "Addicted": can be replaced by "passion" or "favorite or must-play": can be replaced by "recommended" or "worth trying".

[0148] These alternative words are carefully selected to ensure that information transmission to minors is more friendly and safe, and to avoid direct exposure of sensitive content; by replacing sensitive words with subtitles, the risk of minors being exposed to inappropriate information can be effectively reduced without losing the essential nature of the information; building a safer barrier for the information environment of minors will help improve the accuracy of information filtering and processing.

[0149] Step S3023 compares the suspicious words appearing in the SMS data with the subtitle data set. Subtitles are designed to replace sensitive words, but in actual use, subtitles may also carry certain hidden risks. The system determines whether there is a harmful risk based on factors such as the frequency of occurrence and context of subtitles. This process is achieved by analyzing the suspiciousness of subtitles, that is, judging whether the subtitles are still potentially misleading or harmful; by analyzing the suspiciousness of subtitles, the system can detect potential harmful information that may still exist, especially those risky information expressed in a hidden way; thus helping to further filter or shield potential risks to minors and enhance the depth of information security protection.

[0150] Step S3024 performs a similarity test on the SMS message replaced with the subtitle pronouns and the sensitive words in the sensitive word library for minors. This test process can determine whether the subtitle pronouns may still represent harmful information by calculating text similarity (such as cosine similarity, Jaccard similarity, etc.); when the similarity test result shows that the similarity between the substitute word of the subtitle pronoun and the sensitive word is high, the SMS content is judged as harmful information and marked as "risky SMS information"; similarity detection can improve the recognition ability of harmful information after the subtitle pronouns are replaced. Even if the sensitive words have been replaced by subtitle pronouns, the system can still judge their potential harmfulness through semantic similarity; thus effectively ensuring the accuracy of information security processing, even after the subtitle pronouns are replaced, the system can further identify and shield the possible impact on minors.

[0151] The above steps together constitute a comprehensive mechanism for protecting the information of minors. From the capture, classification, and replacement of suspicious words to the final similarity detection, each link is minimizing the potential risks of harmful information to minors, thereby effectively identifying, replacing and detecting sensitive information and building a multi-level protection system. This process not only improves the ability to identify and filter potentially harmful information, but also protects the information security of minors without losing the accuracy and efficiency of information transmission.

[0152] In a preferred embodiment of the present invention, the above step S400 may include:

[0153] Step S401, tracing back the IP address according to the metadata sent by the SMS data; the metadata includes the first eight digits of the sending number, the HTTP request header, and the domain name registration information of the SMS link;

[0154] Step S402, based on the metadata, to obtain the IP address of the SMS data. When the SMS IP address is an overseas address, the suspicious degree of harmful information is high; and further judgement is made in combination with the text information of the SMS data; when the text information identifies words related to money and personal safety, a warning message is promptly sent to the user number of the receiving end; so as to identify the suspicious SMS data of harmful information.

[0155] In this embodiment, in step S401, by analyzing the metadata of the SMS, the source IP address of the SMS is tracked to provide basic information support for identifying harmful information. Specifically, the following metadata are included; thereby helping to preliminarily determine the country or region of origin of the SMS and provide the geographical distribution information of the sender; recording the HTTP request header information during the SMS sending process, which may contain key information such as proxy server information or data packet source, to help trace the source; domain name registration information of the SMS link: a registration query is performed on the domain name of the link contained in the SMS content, which can determine whether the link has a legal registration or a malicious link, and help determine the credibility of the source of the SMS; by analyzing these metadata, the system can preliminarily determine the legitimacy of the source of the SMS and provide direction for the next step of IP address acquisition; thereby helping to lock in the potential source of risky SMS in the early stage. The information contained in the metadata can quickly screen out SMS with obvious abnormal characteristics, thereby effectively narrowing the scope of tracing; tracing the IP address of the SMS sending can provide a geographical basis for the next step of judgment (such as overseas IP), helping to determine the risk level of the SMS; providing a multi-dimensional basic data support, including a comprehensive analysis of number segments, request headers and domain name registration information, which helps to improve the accuracy of tracing.

[0156] Step S402 acquires the IP address based on the metadata provided in step S401. The specific decision logic is as follows:

[0157] By parsing the obtained IP address, its source is determined. If the IP address belongs to a foreign country (i.e., a non-local or domestic IP), the SMS is considered to be highly suspicious; the SMS text content is further parsed to identify whether it contains sensitive keywords such as money or personal safety. For example, words such as "winning", "transfer", "account freeze", and "emergency contact" often appear in fraudulent SMS; when keywords containing potential risks are identified, a warning message will be sent to the receiving user's number to remind the user to be vigilant and prevent being deceived; through the dual judgment of foreign IP and text content, the system can significantly improve the accuracy of identifying harmful information. SMS from foreign IPs are often risky, and combined with the specific analysis of the text content, the misjudgment rate can be effectively reduced; the sending of targeted warning information can allow users to understand potential risks in real time, thereby strengthening their awareness of prevention, playing a timely warning effect, and reducing the possibility of users being deceived due to information asymmetry; the two-layer judgment system can provide a more intelligent and proactive security protection mechanism, especially for dealing with cross-border SMS fraud, and quickly screening out high-risk information.

[0158] In a preferred embodiment of the present invention, the above step S500 includes:

[0159] Step S501, collecting statistics on the sending time, sending user information and sending content of the SMS data containing harmful information to obtain harmful information sending characteristic data;

[0160] Step S502, based on the harmful information sending characteristic data, analyzing the usage behavior of the user number that frequently receives harmful information, wherein the user number usage behavior includes browsing, reading, sending and receiving SMS data, to obtain usage behavior security analysis data;

[0161] Step S503, based on the usage behavior security analysis data, to obtain harmful information sending rule characteristic data; according to the harmful information sending rule characteristic data, to obtain the user number currently defined label data; the user number currently defined label data is updated to obtain a safe user number.

[0162] In this embodiment, step S501 collects data statistics on SMS messages containing harmful information, specifically including three aspects of data: recording the time when each SMS message containing harmful information is sent; sending user information: obtaining relevant information of the user who sent the harmful information, such as number, account ID, etc.; collecting the SMS content itself, mainly the text content containing harmful information; through the statistics of these data, the system can capture the sending mode and regularity of harmful information, and provide a data basis for subsequent analysis; the collection of statistical data provides a basis for analyzing the propagation characteristics of harmful information. For example, whether a certain period is a high-incidence period of harmful information, or whether some users have the behavior of repeatedly sending harmful information, can effectively identify potential sources of risk; harmful information sending characteristic data helps in the in-depth analysis of user behavior in the subsequent steps, and identifies potential malicious behavior and information propagation chains.

[0163] Step S502 will conduct further usage behavior analysis based on the harmful information transmission feature data collected in step S501, especially "user numbers that frequently receive harmful information". The specific content of the analysis includes: analyzing whether the user frequently browses harmful information in text messages; checking whether the user habitually opens and reads text messages containing harmful content; whether the user actively sends text messages containing harmful information to others; whether the user frequently receives harmful information; these behaviors are used to evaluate the overall security of the user number. By comprehensively analyzing these behaviors, the user's interaction pattern with harmful information can be understood; through detailed usage behavior analysis, the system can find users who may inadvertently contact and spread harmful information, or users who actively spread harmful content; a comprehensive analysis of user behavior helps to identify abnormal patterns. For example, some users frequently receive, read and forward harmful text messages, which may indicate that the user is the source or victim of harmful information; this in-depth analysis of behavioral data provides an important basis for subsequent security assessment and labeling of user numbers.

[0164] Step S503 uses the behavior security analysis data as a basis to further derive rule feature data for harmful information transmission. These rule feature data describe typical patterns of harmful information transmission, such as:

[0165] Sending frequency: whether the user sends harmful information frequently.

[0166] Dissemination range: whether the user frequently forwards harmful information to multiple other users.

[0167] Behavioral relevance: whether the user's behavior is associated with certain typical harmful information dissemination patterns.

[0168] Based on these rule feature data, the system will assign and update the currently defined label data for each user number. Labels can be defined based on risk levels (such as high risk, low risk, etc.) or based on user behavior patterns (such as malicious spreaders, frequent receivers, etc.); updated user label data can provide decision support for subsequent security management, risk warnings, etc.

[0169] By mining the characteristic data of harmful information sending rules, the system can establish a more accurate harmful information dissemination model, identify and predict potential harmful information disseminators; updating the user's security label can reflect the user's behavior changes in real time. If the user's behavior pattern becomes unsafe or abnormal, the label will automatically adjust to provide real-time warnings; this dynamic label update based on behavioral data helps to quickly identify risky users and take corresponding safety measures according to the risk level, improving the system's response efficiency; it constitutes a user risk assessment and monitoring system based on behavioral data, which aims to identify potential risky users and implement dynamic safety management through analysis of harmful information dissemination patterns.

[0170] Based on the above-mentioned behavior analysis and dynamic labeling mechanism, it not only improves the accuracy of risk identification, but also helps the system adjust security strategies according to the user's real-time behavior, providing more efficient protection for information security.

[0171] In a preferred embodiment of the present invention, the above step S503 includes:

[0172] Step S5031, according to the usage behavior security analysis data, by: To obtain the abnormal degree of user number usage; where D u Indicates the abnormal degree of user number usage; f u represents the frequency of harmful information received by the user, that is, the number of harmful text messages received within the time window H; μ represents the average frequency of harmful information received by all users; σ represents the standard deviation of the frequency of harmful information received by all users;

[0173] Step S5032: set a preset threshold range and set the abnormal degree of user number usage D u Compare with the preset threshold range, and judge whether the user number usage behavior is normal or abnormal based on the comparison result;

[0174] Step S5033: define a label for the user number according to the usage behavior of the user number to obtain currently defined label data for the user number; the currently defined label data for the user number includes two labels: normal and abnormal.

[0175] In this embodiment, step S503 identifies abnormal behavior by calculating the abnormal degree of use of the user number and calculates the deviation degree between the harmful information frequency of the user number and the overall average frequency. u When the value is large, it means that the user number has received an abnormally large number of harmful text messages within the time window H, indicating that the number may be under concentrated attack or being used to spread harmful information; by counting the frequency of harmful information, the system can quickly identify user numbers that frequently receive harmful text messages, facilitating further tracking and investigation; this indicator provides a quantitative abnormal behavior measurement for subsequent steps, which helps to accurately screen potential victim numbers; it provides dynamic behavior analysis capabilities to facilitate adaptation to changes in harmful information in different time periods, making the system's detection capabilities more flexible.

[0176] Step S5032: Based on the user abnormality DuDu calculated in step S5031, this step determines whether the user behavior is abnormal through a preset threshold range:

[0177] The system sets a threshold range to determine user number behavior.

[0178] When Du exceeds the upper threshold, it is marked as abnormal behavior; if it is within the threshold range, it is regarded as normal behavior; when Du is lower than the upper threshold, it is marked as data fluctuation and inaccurate, and returns to step S5031 to re-acquire the abnormality degree. The threshold can be dynamically adjusted according to historical data or different risk strategies to adapt to different security environment requirements; effectively distinguish between normal user behavior and abnormal behavior, reduce false alarm rate, and ensure that only truly suspicious numbers are marked; the dynamically adjusted threshold can optimize the judgment criteria according to actual conditions, making the detection system more flexible and adaptable; by providing a regularized standard, it helps to efficiently filter out potential abnormal users in a large amount of user data.

[0179] Step S5033 defines a behavior label for the user number based on the judgment result of step S5032:

[0180] If the user number behavior is judged to be normal, it is assigned a "normal" label.

[0181] If it is judged as abnormal behavior, it will be given an "abnormal" label.

[0182] The tag data serves as the system's definition record of the user's number behavior, which facilitates subsequent statistical analysis, behavior tracking, or other further security measures.

[0183] User numbers are managed in layers through labels, making it easier to identify and monitor potential risk numbers. Label data serves as the basis for subsequent security strategies and behavioral analysis, providing effective historical records to help identify behavioral patterns or abnormal behavior trends. The management of large numbers of numbers is simplified, and labeled information can more clearly display the behavioral status of each number, improving system operation and maintenance efficiency.

[0184] Step S5034, based on the currently defined tag data of the user number, obtaining the login information, purchase behavior, browsing history or interaction history of the system platform used by the user number to obtain a tag source data set;

[0185] Step S5035, based on the tag source data set, providing the user with a prompt for selective tag cleaning, so that the user can clean and update the currently defined tag data to obtain an initialized defined tag;

[0186] Step S5036: Based on the initialization, define a tag to make the current user number a safety number.

[0187] In this embodiment, step S5034 starts from the current tag data of the user number and collects the user's behavior data on the system platform, such as login information, purchase behavior, browsing history and interaction history, to construct a tag source data set; by recording the user's login behavior on different system platforms, to identify their activity and platform preferences; analyze the user's purchase history, judge their consumption habits and frequency, and identify possible abnormal consumption behavior; collect the user's content browsing situation on the platform, understand their interests and access frequency, and discover abnormal browsing behavior; including interaction with other users or platform content (such as likes, comments, forwarding, etc.), can reveal the user's behavior pattern in social or content consumption; the data is integrated into a tag source data set to provide the specific source of user behavior, so as to more accurately understand the basis for the formation of user tags; thereby, it is possible to more comprehensively understand the behavior pattern of the user number and provide a more detailed source of tag information; through the establishment of the data set, it is helpful to identify potential abnormal behavior and provide a reliable basis for subsequent security judgments; refined behavior analysis enables the system to more accurately adjust and optimize the user's tag status and improve the accuracy of the tag.

[0188] Step S5035 provides users with selective prompts for cleaning labels based on the label source data set in step S5034; identifies label data that is inconsistent with user behavior or is obviously abnormal; users can choose to "clean" or adjust labels to delete, modify or update label information that no longer conforms to the actual situation; the cleaned label data will be redefined and updated to the "initialized definition label" state; the selective cleaning function allows users to decide whether to retain or update certain labels, thereby enhancing user autonomy in data cleaning; keeps label data dynamically updated to ensure that the system can always reflect the user's latest behavior information and improve the authenticity and validity of label data; effectively prevents mislabeled or outdated label data from having a negative impact on the user's behavior evaluation and maintains the high accuracy of system judgments.

[0189] Step S5036 marks the user number that meets the security standards as a "safe number" through the initialization definition label state after the user cleansing; the initialization definition label reflects the user's real behavior pattern after cleaning, and conforms to normal or safe label data; based on the initialization state of these label data, it is judged whether the user behavior is normal, and the user number that meets the standard is marked with a "safe number" state; this mark can be used for subsequent system management to ensure that the safe number is free from further security interference or restrictions; thereby improving the accuracy of the system, avoiding the mistaken marking of risk-free user numbers as abnormal numbers, and enhancing the user experience; focusing on processing user numbers that are truly at risk, and improving overall management efficiency; the definition of a safe number brings a clearer security identification to the user, which facilitates subsequent number status tracking and management.

[0190] The above describes an embodiment of the present invention, but this embodiment is not limited to the above-mentioned specific implementation mode. The above-mentioned specific implementation mode is merely illustrative and not restrictive. Under the guidance of this embodiment, ordinary technicians in this field can also make more forms of equivalent embodiments, all of which are within the protection of this embodiment.

Claims

1. A method for identifying harmful information in text messages based on big data, characterized in that: The following steps are involved: S100, collecting multiple harmful information SMS history samples to obtain a harmful information history sample set; compiling harmful information keywords in the sample set into multiple language versions to train an information recognition model, and outputting harmful information feature recognition results; The information recognition model includes a first module, a second module and a third module; S200, inputting the SMS data sent by the sending end in real time into the information recognition model; The first module receives the SMS data for scanning and reading to output initial suspicious harmful information SMS data; S300, transmitting the SMS data identified by the first module to the second module, the second module identifying the suspicious harmful information character features in the initial suspicious harmful information data, and obtaining the meaning of the suspicious characters to output secondary suspicious harmful information SMS data; S400, inputting the SMS data identified by the second module into the third module, the third module traces the IP address of the SMS data sender to obtain the source tracing information of the SMS data sender, and outputs the final identification result of the suspicious SMS data of harmful information according to the source tracing information; when the SMS data containing harmful information is identified, executing step S500; S500, performing sending feature analysis on the SMS data containing harmful information to obtain harmful information sending rule feature data; Based on the harmful information sending rule characteristic data, the current definition label data of the user number is obtained, and the current definition label of the user number is updated to obtain a safe user number.

2. According to claim 1, a method for identifying harmful information in text message content based on big data is characterized in that: Collecting multiple harmful information SMS history samples to obtain a harmful information history sample set; compiling the harmful information history sample set into multiple language versions to train an information recognition model to output harmful information feature recognition results; The information identification model comprises a first module, a second module and a third module, including: Collect historical sample data of various SMS sources containing harmful information, including fraudulent SMS, horrific and bloody SMS, pornographic and obscene SMS, and virus links; Based on the historical sample data, keywords containing harmful information in the historical sample data are converted into multiple target language versions; and multiple target language versions of multiple keywords are semantically verified to obtain an accurate translation data set; The accurate translation dataset is obtained by: i ={wSim(k i ,w)>α} to obtain similar words of multiple keywords; where w represents the feature parameter of similar words; K i represents a keyword; α represents a similarity threshold; based on the obtained similar words of the multiple keywords, by: To obtain a keyword similar semantic expansion set; and combine the keyword similar semantic expansion set with the keyword K i Fusion is a comprehensive sample set; where, represents the final multilingual similar keyword expansion set; m represents the number of similar keywords; represents the expansion function; The comprehensive sample set is constructed into a training set: G = {n1, n2, ..., n i }; where n i Represents the i-th accurate translation data item; the training set G is input into the information recognition model for training to output the harmful information feature recognition result.

3. The method for identifying harmful information in text message content based on big data according to claim 2, characterized in that: Input the SMS data sent by the sender in real time into the information recognition model; The first module receives the SMS data for scanning and reading to output initial harmful information suspicious SMS data, including: The newly sent SMS data is input into the information recognition model, and the first module extracts SMS data with similar format templates that are repeated multiple times to obtain similar template text data; The similar template text data D is pre-screened by setting a format similarity rule set {R i } n i =1; by traversing each template text T in the SMS data j ; For each T j The template text data is formatted and analyzed to obtain the template text data format rule R i The matching situation; if T j Does not meet R i If the format rule is met, it will be retained in the template text data with different formats, otherwise it will be discarded; in order to filter out the template text data with unified format; the template text data with unified format is the initial harmful information suspicious data.

4. The method for identifying harmful information in text message content based on big data according to claim 3, characterized in that: The SMS data identified by the first module is transmitted to the second module, and the second module identifies the suspicious character features of harmful information in the initial suspicious harmful information data, and obtains the meaning of the suspicious characters to output secondary suspicious harmful information SMS data, including: Further reading SMS text characters from the template text data of different formats to obtain a suspicious character feature data set in the text; the suspicious character feature data includes misleading words in multiple languages; Identify and annotate each suspicious character feature data to obtain a corresponding category data set; the corresponding category data set includes annotating multilingual words into fraud, violence and blood, pornography and filth, and terror; Based on the suspicious character feature data set, the template text data of different formats are parsed according to the context, by: To judge the meaning of the character data item of the character feature data set is suspicious, where F(t i ) indicates the final parsed meaning of the character data item; t i Indicates the meaning of the i-th template text fragment; C(t i ) represents the template fragment t i The inference parameter of ; T represents the corresponding category data set; Indicates inference symbol; Based on the obtained judgment results, through: To obtain the frequency of suspicious characters, where fi represents the frequency of suspicious characters in SMS data; C represents the number of times suspicious characters appear; W represents the total number of characters in SMS data; and the SMS data with suspicious characters is subjected to secondary screening to obtain secondary harmful information suspicious data.

5. The method for identifying harmful information in text message content based on big data according to claim 4, characterized in that: Each suspicious character feature data is identified and annotated to obtain a corresponding category data set; the corresponding category data set includes multilingual words annotated as fraud, violence and blood, pornography and filth, and terror, including: Based on the corresponding category data set, suspicious words in the text message are captured, and the suspicious words in the text message data are matched with the corresponding category data set to obtain a matching data set; based on the matching data set, a sensitive word library for minors is established; Based on the sensitive word library for minors, sensitive words or inappropriate words in the sensitive word library for minors are replaced with latent pronouns that are safe and suitable for minors to obtain a latent pronoun dataset; By comparing the suspicious words in the SMS data with the subtitle pronoun data set and judging the suspiciousness of the subtitle pronouns, the harmful risk of the suspicious subtitle pronouns is analyzed to obtain risk SMS information; The risk SMS information is tested for similarity with sensitive words in a sensitive word library for minors to determine whether the potential pronouns in the SMS data are harmful information data.

6. A method for identifying harmful information in text message content based on big data according to claim 5, characterized in that: The risk SMS information is tested for similarity with sensitive words in the sensitive word library for minors to determine whether the suspicious words in the SMS data are harmful information data, including: According to the similarity detection, the matching degree of the minor sensitive words is obtained; based on the matching degree, the risk SMS information is further fuzzy matched and analyzed to obtain accurate matching data; Based on accurate matching data, the potential pronouns in the SMS data are determined to be harmful information data, and an information feedback channel is set up; Based on the feedback channel, inappropriate information is fed back in a timely manner and the feedback information is automatically categorized and prioritized to update the sensitive word library for minors to obtain feedback results.

7. The method for identifying harmful information in text message content based on big data according to claim 6, characterized in that: The SMS data identified by the second module is input into the third module, and the third module traces the IP address of the SMS data sender to obtain the source tracing information of the SMS data sender, and outputs the final harmful information suspicious SMS data identification result according to the source tracing information, including: Tracing back the IP address based on metadata sent by the SMS data; the metadata includes the first eight digits of the sending number, the HTTP request header, and the domain name registration information of the SMS link; Based on the metadata, the IP address of the SMS data is obtained. When the SMS IP address is an overseas address, the suspicious degree of harmful information is high; and further judgment is made in combination with the text information of the SMS data; when the text information identifies words related to money and personal safety, a warning message is promptly sent to the user number of the receiving end; so as to identify the suspicious SMS data of harmful information.

8. The method for identifying harmful information in text message content based on big data according to claim 7, characterized in that: The method includes: performing a sending feature analysis on the SMS data containing harmful information to obtain harmful information sending rule feature data; obtaining currently defined label data of the user number based on the harmful information sending rule feature data, and updating the currently defined label of the user number to obtain a safe user number, including: Collect statistics on the sending time, sending user information and sending content of SMS data containing harmful information to obtain the sending characteristic data of harmful information; Based on the harmful information sending characteristic data, the user number that frequently receives harmful information is analyzed for usage behavior, wherein the user number usage behavior includes browsing, reading, sending and receiving SMS data; to obtain usage behavior security analysis data; Based on the usage behavior security analysis data, harmful information sending rule characteristic data is obtained; according to the harmful information sending rule characteristic data, the user number currently defined label data is obtained; the user number currently defined label data is updated to obtain a safe user number.

9. The method for identifying harmful information in text message content based on big data according to claim 8, characterized in that: According to the harmful information sending rule characteristic data, the current defined label data of the user number is obtained, including: According to the usage behavior security analysis data, through: To obtain the abnormal degree of user number usage; where D u Indicates the abnormal degree of user number usage; f u represents the frequency of harmful information received by the user, that is, the number of harmful text messages received within the time window H; μ represents the average frequency of harmful information received by all users; σ represents the standard deviation of the frequency of harmful information received by all users; Set the preset threshold range and set the abnormal degree of user number usage D u Compare with the preset threshold range, and judge whether the user number usage behavior is normal or abnormal based on the comparison result; According to the usage behavior of the user number, a label is defined for the user number to obtain the currently defined label data of the user number; the currently defined label data of the user number includes two labels, normal and abnormal.

10. The method for identifying harmful information in text message content based on big data according to claim 9, characterized in that: The currently defined tag data of the user number is updated to obtain a secure user number, including: Based on the currently defined tag data of the user number, the login information, purchase behavior, browsing history or interaction history of the system platform used by the user number is obtained to obtain a tag source data set; Based on the label source data set, provide the user with a prompt for selective label cleaning, so that the user can clean and update the current defined label data to obtain an initialized defined label; Based on the initialization, a tag is defined to make the current user number a safety number.

Images