Conceptual drift resisting method for junk mail detection based on comparative learning and active learning
By comparing the method of measuring sample similarity and actively learning to select samples for labeling, the performance degradation of spam detection models during concept drift is solved, the stability and adaptability of the model are achieved, and the annotation cost is reduced.
Patent Information
- Application Number
- CN202510274654.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-10
- Publication Date
- 2025-06-20
AI Technical Summary
When facing concept drift, existing spam detection models need to re-collect a large amount of data and re-train the model, resulting in large consumption of computing resources and long training time, unable to adapt to changes in the data environment in time, and difficult to maintain stable detection performance.
The sample similarity measurement method provided by contrast learning is used to measure the similarity by calculating the Euclidean distance between two samples in the embedded space, identify the drifted spam samples, and combine the active learning scheme with uncertainty metric (pseudo-loss) to select samples with high classification uncertainty for labeling and training, and continuously update the model to adapt to the data distribution changes.
Through comparative learning, we can better capture subtle differences between spam and normal emails, identify concept drift and adapt to changes, the active learning scheme reduces labeling costs, improves the detection performance of the model, and achieves effective response to concept drift.
Smart Images
Figure CN120180223A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information science and technology, and specifically to a spam detection anti-concept drift method based on contrast learning and active learning. Background Art
[0002] In recent years, the proliferation of spam has brought great troubles to users and seriously endangered the network security of users. Machine learning methods can effectively solve the problem of spam proliferation. Machine learning models learn the characteristics of spam and normal emails from a large number of labeled email data through algorithms, and predict whether a new email is spam by analyzing the feature distribution of the emails.
[0003] Although machine learning models have great advantages in spam detection, when facing concept drift, it is usually necessary to re-collect a large amount of email data and re-train the model. This process consumes a large amount of computing resources and takes a long training time. It cannot adapt to the constantly changing email data environment in a timely manner and is difficult to maintain stable detection performance. Therefore, it is necessary to design a continuously updated classifier model to adapt to concept drift and keep the classifier's spam detection performance stable.
[0004] In this context, some ideas of combining similarity-based feature selection techniques to detect changes and update the model have been proposed. For example, "Spam Detection Based on Feature Evolution to Deal with Concept Drift" proposed a spam detection framework ADDrift. This framework uses the SFS (similarity-based feature selection) strategy to analyze the similarity of feature vectors between training data (source domain) and test data (target domain) to detect concept drift. The cosine value of the angle between two feature vectors is used to measure the similarity. By analyzing the distribution of similarity values, a threshold is set. If the similarity of a sample in the test data to the source domain is lower than the threshold, the sample is stored in a temporary library. When the samples in the temporary library reach a certain time window, the dissimilar samples stored in the temporary library are used to update the model to improve the detection performance of the model.
[0005] The above - mentioned technology has achieved certain results. However, for the ADDrift framework, although the SFS (similarity - based feature selection) strategy reduces the number of email samples that need to be labeled, it does not further select the samples with the highest dissimilarity to train the model. Therefore, a certain amount of labeled sample data is still required to train the model to significantly improve the model's detection performance. And using cosine similarity to measure the similarity between feature vectors cannot capture all important changes in email features because the changes in some features are not obvious in the cosine similarity measurement, but these feature changes have a certain impact on the improvement of the model's performance. Moreover, when the feature distribution of email data changes rapidly, improper selection of the time window will lead to unstable model performance. If the time window is selected too small, it may cause the model to be updated frequently, increasing the computational cost; if the time window is selected too large, it may cause the model to fail to adapt to concept drift in a timely manner, and the detection performance begins to decline.
[0006] Based on the above, therefore, an anti - concept - drift method for spam detection based on contrastive learning and active learning is invented. By adopting contrastive learning, a method for measuring sample similarity is provided. The similarity of samples can be measured by calculating the Euclidean distance between two samples in the embedding space, which can better capture the subtle differences between spam and normal emails. When drifting spam appears, through its similarity measurement, these samples can be identified as similar to past spam samples, better adapting to concept drift. At the same time, an active learning scheme is adopted to use uncertainty measurement (pseudo - loss) to select email samples with high classification uncertainty of the model for certain samples. These samples are selected and handed over to analysts for labeling, and then added to the training set. The classifier is continuously trained using the warm - start strategy, and this process is continuously cycled. Then, only a small part of key samples need to be labeled to improve the model's detection performance, reduce the labeling cost of emails, and continuously update the classifier to achieve the purpose of adapting to concept drift. Summary of the Invention
[0007] To solve the above - mentioned technical problems, according to one aspect of the present invention, the following technical solutions are provided:
[0008] An anti - concept - drift method for spam detection based on contrastive learning and active learning, which includes the following specific steps:
[0009] S1: Collect an email data set, including historical data and new data. Further divide the data set into a training set, a validation set, and a test set. Extract the features of the emails, construct a contrastive learning model, use the training set data to train the contrastive learning model, and design a training loss function that combines contrastive loss and classification loss to train the model end - to - end;
[0010] S2: Select new samples to update the classifier to cope with the process of concept drift;
[0011] S3: First, decompose the email sample into the body and the email title, and use a regularization method to delete the sender and recipient information, dates, punctuation marks, and special characters. Then, standardize the content of the email by converting the email content to lowercase uniformly, replacing common abbreviations with full forms, using the stopword list provided by NLTK to remove common words that are meaningless for classification, restoring the word form, and removing duplicate emails or paragraphs. After that, use the Jieba tool to perform word segmentation on the email body, extract features from the email content, and count the occurrence frequency of each word in the email.
[0012] S4: First, input the email sample x that has undergone word segmentation into the contrastive learning model, and then use the contrastive learning method to train the contrastive learning model. Among them, the training includes encoder training and classifier training.
[0013] As a preferred solution of a spam detection anti-concept drift method based on contrastive learning and active learning according to the present invention, wherein: in the S1, the contrastive learning model is divided into two sub-networks. The first sub-network is the encoder enc, which generates an embedding for the input z = enc(x). The second sub-network acts as a classifier g, which uses the embedding vector z and predicts the binary label g(z) of the input.
[0014] As a preferred solution of a spam detection anti-concept drift method based on contrastive learning and active learning according to the present invention, wherein: the selection steps of the new sample in the S2 are as follows:
[0015] Step 1: Input any email sample x in the test set i into the contrastive learning model, where the encoder maps the email sample x i to the embedding space to obtain the embedding vector of the email sample, and input the embedding vector into the classifier, and the classifier outputs the predicted label of the email sample
[0016] Step 2: Use the encoder enc to calculate the embedding enc(x i ) of the test sample x i as z i = enc(x i ), and calculate the embedding enc(x j ) of all training samples as z j = enc(x j );
[0017] Step 3: Normalize all the embedding vectors, and find 2N - 1 nearest neighbor samples of the test sample x i in the training set, and construct a set containing the test sample x iand its 2N - 1 nearest neighbor samples;
[0018] Step Four: Use the predicted label as the pseudo - label of x i and use the true label for all 2N - 1 training samples, calculate the pseudo - loss of the test sample x i The calculation includes the classification loss and the contrast loss, and the formula is as follows: including the calculation of classification loss and contrast loss, the formula is as follows:
[0019]
[0020] Step Five: Sort the calculated pseudo - loss values from low to high, select the samples with high pseudo - loss and hand them over to the analyst for labeling. Then continue the active learning process, add the labeled samples to the training set, and use the previously saved model weights as the initial weights to continue training the model;
[0021] Step Six: Repeat the above steps, select new samples based on the predicted label and measure of uncertainty to continuously update the model, help the model adapt to the change of email data distribution, and reduce the impact of concept drift.
[0022] As a preferred solution of the spam detection anti - concept - drift method based on contrast learning and active learning described in the present invention, wherein: the process of encoder training in S4 is as follows:
[0023] Process One: Input the email sample data x i in the training set into the encoder enc, calculate its linear transformation h i = w i x + b i , and then apply the ReLU activation function h i = max(0, h i ). Initialize the weight matrix w i and the bias vector b i using the Xavier method, map the email sample x i to a low - dimensional embedding space, obtain the embedding vector of the email sample, and calculate the distance between the embedding vectors of samples;
[0024] Process Two: According to the label of the email sample, for email samples of the same category, use the contrast loss function L hc (i)= max(0, d ij - m), set a distance threshold m. If the distance between two samples in the embedding space is greater than m, penalize them to make the embedding vectors of email samples of the same category in the encoder closer;
[0025] Process Three: For email samples of different categories, use the contrast loss function L hc(i) = max(0, 2m - d ij ), a hyperparameter 2m is set. When the distance is less than 2m, it needs to be penalized to make the embedding vectors of different categories of email samples in the encoder far away from each other;
[0026] Step Four: Repeat the above steps to optimize the embedding space and obtain the encoder with fine-tuned parameters.
[0027] As a preferred solution of a spam detection anti-concept drift method based on contrastive learning and active learning according to the present invention, wherein: the process of training the classifier in S4 is as follows:
[0028] Step One: Input the email sample data x in the training set i into the fine-tuned encoder enc. According to the email sample embedding vector z mapped by the encoder i = enc(x i ), which is used as the input of the classifier g, and the output of the softmax layer is g(z i );
[0029] Step Two: The predicted label of the sample output by the classifier g is When g(z i ) ≥ 0.5, Otherwise Classify the email according to the predicted label , where represents a normal email, represents a spam email;
[0030] Step Three: First, calculate the binary cross-entropy loss according to the predicted label of the email sample and the class label of the email sample. The loss function is as follows: Then use the loss function to train the model;
[0031] Step Four: Repeat the above steps to adjust the parameters of the classifier.
[0032] Compared with the prior art:
[0033] The advantages of the present invention are as follows: By using contrastive learning, a method for measuring the similarity of samples is provided. The similarity of samples can be measured by calculating the Euclidean distance between two samples in the embedding space, which can better capture the subtle differences between spam and normal emails. When there are drifting spam emails, through its similarity metric, it can be identified that these samples are similar to past spam samples, better adapting to concept drift. At the same time, an active learning scheme is adopted to use uncertainty metrics (pseudo-loss) to select email samples with high classification uncertainty of the model for certain samples, select these samples and hand them over to analysts for labeling, then add them to the training set, and continue to train the classifier using the warm start strategy. By continuously cycling this process, only a small number of key samples need to be labeled to train the model, which can help the model adapt to changes in the data distribution, improve the detection performance of the model, and reduce the annotation cost of emails. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] Figure 1 It is a process diagram for the present invention to select new samples to update the model to adapt to concept drift. DETAILED DESCRIPTION OF THE INVENTION
[0035] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.
[0036] The present invention provides a spam detection anti-concept drift method based on contrastive learning and active learning. Please refer to Figure 1 , and the specific steps are as follows:
[0037] S1: Collect the email dataset, including historical data and new data. Further divide the dataset into a training set, a validation set, and a test set. Extract the features of the emails, construct a contrastive learning model, use the training set data to train the contrastive learning model, and design a training loss function that combines contrastive loss and classification loss to train the model end-to-end; this training loss function encourages the encoder to make the embedding vectors of email samples of the same category (between normal email samples and between spam email samples) close to each other, and the embedding vectors of email samples of different categories (between normal and spam emails) far from each other;
[0038] Among them, the contrastive learning model is divided into two sub-networks. The first sub-network is the encoder enc, which generates an embedding for the input z = enc(x); the second sub-network acts as a classifier g, which takes the embedding vector z and predicts the binary label g(z) of the input;
[0039] S2: The process of selecting new samples to update the classifier to cope with concept drift;
[0040] Among them, the selection steps of the new samples are as follows:
[0041] Step 1: Input any email sample x in the test set i into the contrastive learning model, where the encoder maps the email sample x i to the embedding space to obtain the embedding vector of the email sample, and input the embedding vector into the classifier, and the classifier outputs the predicted label of the email sample
[0042] Step 2: Calculate the embedding enc(x i ) of the test sample x using the encoder enc i as z i = enc(x i ), and calculate the embeddings enc(x j ) of all training samples as z j = enc(x j );
[0043] Step 3: Normalize all embedding vectors, find the 2N - 1 nearest neighbor samples of the test sample x i in the training set, and construct a pair containing the test sample x i and its 2N - 1 nearest neighbor samples;
[0044] Step 4: Use the predicted label as the pseudo - label of x i , and use the true label for all 2N - 1 training samples, and calculate the pseudo - loss i of the test sample x which includes the calculation of classification loss and contrastive loss, and the formula is as follows:
[0045]
[0046] Step 5: Sort the calculated pseudo - loss values from low to high, select the samples with high pseudo - loss (uncertainty) and hand them over to the analyst for labeling, then continue the active learning process, add the labeled samples to the training set, and use the previously saved model weights as the initial weights (hot - start strategy) to continue training the model;
[0047] Step 6: Repeat the above steps, select new samples based on the predicted label and measure the uncertainty to continuously update the model, help the model adapt to the change of the email data distribution, and reduce the impact of concept drift;
[0048] where represents the set of samples with the same class label as the test sample x i , represents the set of samples with different class labels from the sample x i , m is the distance threshold (hyperparameter), λ represents the hyperparameter used to balance the contrastive loss and the classification loss, d ijrepresents the Euclidean distance between two arbitrary samples i and j in the embedding space;
[0049] S3: First, decompose the email sample into the body and the email title, and use a regularization method to delete the sender and recipient information, date, punctuation marks, and special characters; then standardize the content of the email, convert the email content to lowercase uniformly, replace common abbreviations with full forms, use the stopword list provided by NLTK to remove common words that are meaningless for classification, restore the word form, and remove duplicate emails or paragraphs; after that, use the Jieba tool to perform word segmentation on the email body, extract features from the email content, and count the occurrence frequency of each word in the email;
[0050] S4: First, input the tokenized email sample x into the contrastive learning model, and then use the contrastive learning method to train the contrastive learning model. Among them, the training includes encoder training and classifier training;
[0051] Among them, the process of encoder training is as follows:
[0052] Process 1: Input the email sample data x in the training set i into the encoder enc, calculate its linear transformation h i = w i x + b i , and then apply the ReLU activation function h i = max(0, h i ), initialize the weight matrix w i and the bias vector b i using the Xavier method, map the email sample x i to a low-dimensional embedding space, obtain the embedding vector of the email sample, and calculate the distance between the embedding vectors of the samples;
[0053] Process 2: According to the labels of the email samples, for email samples of the same category, use the contrastive loss function L hc (i) = max(0, d ij - m), set a distance threshold m. If the distance between two samples in the embedding space is greater than m, it will be penalized to make the embedding vectors of email samples of the same category in the encoder close to each other;
[0054] Process 3: For email samples of different categories (between normal email samples and between spam email samples), use the contrastive loss function L hc (i) = max(0, 2m - d ij ), set a hyperparameter 2m. When the distance is less than 2m, it needs to be penalized to make the embedding vectors of email samples of different categories in the encoder far away from each other;
[0055] Process Four: Repeat the above steps to optimize the embedding space and obtain the encoder with fine-tuned parameters.
[0056] The process of classifier training is as follows:
[0057] Process One: Input the email sample data x i in the training set into the fine-tuned encoder enc, and according to the email sample embedding vector z i = enc(x i ), which is used as the input of the classifier g, and the output of the softmax layer is g(z i );
[0058] Process Two: The predicted label of the sample output by the classifier g is When g(z i ) ≥ 0.5, Otherwise Classify the email according to the predicted label , where represents a normal email, represents a spam email;
[0059] Process Three: First, calculate the binary cross-entropy loss according to the predicted label of the email sample and the class label of the email sample. The loss function is as follows: Then use the loss function to train the model;
[0060] Process Four: Repeat the above steps to adjust the parameters of the classifier;
[0061] Among them, y i represents the true label of the sample x i (y i = 0 represents a normal email, y i = 1 represents a spam email), and f(x i ) represents the probability that the model predicts the sample x i as a spam email.
[0062] For Figure 1 , the specific steps are as follows:
[0063] First, it is necessary to collect an email dataset, including historical data and new data. Further divide the dataset into a training set, a validation set, and a test set. Extract the features of the emails and construct a contrastive learning model. The model consists of two sub-networks. The first sub-network is the encoder enc, which generates an embedding for the input z = enc(x). The second sub-network acts as a classifier g, which takes the embedding vector z and predicts the binary label of the input g(z). Use the training set data to train the contrastive learning classifier, and design a training loss function that combines the contrastive loss and the classification loss to train the model end-to-end. Then, select new samples to update the classifier to cope with concept drift. First, it is necessary to calculate the uncertainty of the samples. Since there is no existing uncertainty metric for the model trained using contrastive learning, a pseudo-loss is constructed in the training loss function to calculate the uncertainty of the samples. Obtain the predicted labels by using the trained contrastive learning model to predict the test samples, and find the 2N - 1 nearest neighbor samples of the test samples in the training set. Construct a pair that includes the test sample and its 2N - 1 nearest neighbor samples. Use the predicted label as the pseudo-label of the test sample, and at the same time use the true label for all 2N - 1 training samples. Calculate the contrastive loss for each pair and average these losses. A higher pseudo-loss value means that the model has a high uncertainty about the test sample. It is necessary to select these samples with high pseudo-loss values and hand them over to the analysts for annotation. Add the annotated samples to the training set and use the warm-start strategy to train the classifier. Repeat the process of active learning to select new samples by predicting labels and measuring uncertainty to continuously update the model and reduce the impact of concept drift on the model.
[0064] Although the present invention has been described above with reference to the embodiments, various improvements can be made to it and components therein can be replaced with equivalents without departing from the scope of the present invention. In particular, as long as there is no structural conflict, the various features in the embodiments disclosed in the present invention can be combined with each other in any way. The reason for not exhaustively describing the situations of these combinations in this specification is only to save space and resources. Therefore, the present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.
Claims
1. A spam detection anti-concept drift method based on contrastive learning and active learning, characterized in that: The specific steps are as follows: S1: Collect email datasets, including historical data and new data, further divide the dataset into training set, validation set and test set, extract email features, build a contrastive learning model, use the training set data to train the contrastive learning model, and design an end-to-end training model that combines contrastive loss and classification loss. S2: The process of selecting new samples to update the classifier to cope with concept drift; S3: First, the email sample is decomposed into the body and the email title, and the sender and recipient information, date, punctuation and special characters are removed by regularization. Then, the email content is standardized, the email content is uniformly converted to lowercase, abbreviations are replaced with full forms, and the stop word list provided by NLTK is used to remove common words that are meaningless for classification, restore word forms, and remove duplicate emails or paragraphs. After that, the Jieba tool is used to segment the email body, extract features from the email content, and count the frequency of each word in the email. S4: First, input the email sample x after word segmentation into the contrastive learning model, and then use the contrastive learning method to train the contrastive learning model, wherein the training includes encoder training and classifier training.
2. According to claim 1, a spam detection anti-concept drift method based on contrastive learning and active learning is characterized in that: The contrastive learning model in S1 is divided into two sub-networks, the first sub-network is the encoder enc, which generates an embedding for the input z=enc(x); the second sub-network acts as a classifier g, which takes the embedding vector z and predicts the binary label g(z) of the input.
3. According to claim 1, a spam detection anti-concept drift method based on contrastive learning and active learning is characterized in that: The steps for selecting new samples in S2 are as follows: Step 1: Take any email sample x in the test set i Input to the contrastive learning model, where the encoder converts the email sample x i Map to the embedding space to get the embedding vector of the email sample, input the embedding vector into the classifier, and the classifier outputs the predicted label of the email sample Step 2: Use encoder enc to calculate the test sample x i The embedding enc(x i ) is z i =enc(x i ), calculate the embedding enc(x) of all training samples j ) is z j =enc(x j ); Step 3: Normalize all embedding vectors and find the test sample x in the training set i 2N-1 nearest neighbor samples, construct a test sample x i and its 2N-1 nearest neighbor sample pairs; Step 4: Use the predicted labels As x i The pseudo-labels are used for all 2N-1 training samples, and the true labels are used to calculate the test sample x i The pseudo loss This includes the calculation of classification loss and contrast loss, the formula is as follows: Step 5: Sort the calculated pseudo-loss values from low to high, select samples with high pseudo-loss and hand them over to analysts for labeling, then continue the active learning process, add the labeled samples to the training set, and use the previously saved model weights as the initial weights to continue training the model; Step 6: Repeat the above steps to select new samples to continuously update the model by predicting labels and measuring uncertainty, so as to help the model adapt to changes in the distribution of email data and reduce the impact of concept drift.
4. According to claim 1, a spam detection and anti-concept drift method based on contrastive learning and active learning is characterized in that: The process of encoder training in S4 is as follows: Process 1: The email sample data x in the training set i Input encoder enc, pass through multiple fully connected layers, and calculate its linear transformation h i =w i x+b i , and then apply the ReLU activation function h i =maxo,h i , use the Xavier method to initialize the weight matrix w i and the bias vector b i , the email sample x i Map to a low-dimensional embedding space, obtain the embedding vector of the email sample, and calculate the distance between the embedding vectors of the samples; Step 2: Based on the labels of the email samples, use the contrast loss function L for the same category of email samples hc i=max0,d ij -m), set a distance threshold m. If the distance between two samples in the embedding space is greater than m, it will be penalized so that the embedding vectors of the same category of email samples in the encoder are close; Step 3: Use the contrastive loss function L for different categories of email samples hc i=max0,2m-d ij ), set a hyperparameter 2m. When the distance is less than 2m, it needs to be penalized so that the embedding vectors of different categories of email samples in the encoder are far away from each other; Process 4: Repeat the above steps to optimize the embedding space and obtain the encoder with fine-tuned parameters.
5. According to claim 1, a spam detection and anti-concept drift method based on contrastive learning and active learning is characterized in that: The process of classifier training in S4 is as follows: Process 1: The email sample data x in the training set i Input to the fine-tuned encoder enc, according to the encoder mapped email sample embedding vector z i =enc(x i ), as the input of the classifier g, the softmax layer output is gz i ; Process 2: The predicted label of the sample output by classifier g is When gz i ≥0.5, otherwise According to the predicted label Categorize mail Indicates normal mail. Indicates spam; Process 3: First, calculate the binary cross entropy loss based on the predicted label of the email sample and the class label of the email sample. The loss function is as follows: Then use the loss function to train the model; Process 4: Repeat the above steps to adjust the parameters of the classifier.