Abnormal short message behavior detection method and system based on multi-dimensional feature fusion

Abstract

The application discloses an abnormal short message behavior detection method and system based on multi-dimensional feature fusion, relates to the related technical field of short message security detection, and comprises the following steps: collecting the space-time distribution features, semantic association graphs and device behavior fingerprints of short message interaction, configuring a dynamic feature pool, and extracting cross-modal feature sequences; performing cascade identification; dynamically adjusting a feature fusion weight matrix, generating an abnormal probability score, triggering a multi-stage verification mechanism when the abnormal probability score exceeds a dynamic abnormal probability threshold; matching the timing mode at an edge computing node, dynamically generating a verification code trigger threshold, and performing interactive risk verification to determine an abnormal short message behavior label. The application solves the technical problems of single detection dimension, difficulty in identifying new complex abnormal short message behaviors, and high false positive and false negative rates in the prior art, and achieves the technical effects of reducing the false positive and false negative rates of short message anomaly detection, improving the detection timeliness and adaptability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of short message security detection, and particularly relates to an abnormal short message behavior detection method and system based on multi-dimensional feature fusion. BACKGROUND

[0002] As an important information transmission channel, short messages are applied in various scenarios, such as daily social communication, financial transaction verification, enterprise information push, etc. However, along with the application of short messages, problems such as abnormal short message behaviors, such as spam short message group sending, telecom fraud short message, malicious fee deduction short message, etc., are becoming increasingly serious. Traditional abnormal short message detection methods are mostly based on single-dimensional feature analysis, such as identifying spam short messages through keyword matching or judging abnormalities according to simple rules such as short message sending frequency. However, with the development of technology, criminals use semantic confusion and disguised sending sources to evade detection, making the false positive rate and false negative rate of single feature detection methods high. At the same time, due to the complexity and dynamics of short message behaviors, it is difficult to adapt to diversified attack scenarios and accurately identify new abnormal short message behavior patterns by relying only on static features, and it is difficult to achieve efficient and accurate detection of abnormal short message behaviors.

[0003] Therefore, in the related art, there are technical problems of single detection dimension, difficulty in identifying new complex abnormal short message behaviors, and high false positive and false negative rates, resulting in insufficient detection timeliness and adaptability. SUMMARY

[0004] The present application provides an abnormal short message behavior detection method and system based on multi-dimensional feature fusion, which solves the technical problems of single detection dimension, difficulty in identifying new complex abnormal short message behaviors, and high false positive and false negative rates in the prior art, resulting in insufficient detection timeliness and adaptability, and achieves the technical effects of reducing the false positive and false negative rates of short message anomaly detection and improving the detection timeliness and adaptability.

[0005] The application provides an abnormal short message behavior detection method based on multi-dimensional feature fusion, which comprises the following steps: collecting the space-time distribution features, semantic association graph and device behavior fingerprint of short message interaction, configuring a dynamic feature pool, extracting cross-modal feature sequence through a sliding time window, and determining the mutual information entropy and abnormal deviation degree between each feature dimension; uploading the mutual information entropy and abnormal deviation degree between each feature dimension to a central computing node for cascaded identification, wherein the central computing node comprises a feature selection layer based on an attention mechanism, a time sequence dependence analysis layer and an adversarial sample filtering layer; dynamically adjusting the feature fusion weight matrix according to the cascaded identification result to generate an abnormal probability score, and triggering a multi-stage verification mechanism when the abnormal probability score exceeds a dynamic abnormal probability threshold; and matching the time sequence mode in the user historical behavior baseline in the edge computing node through the multi-stage verification mechanism to dynamically generate a verification code trigger threshold, and combining the context scene features to perform interactive risk verification to determine the abnormal short message behavior label.

[0006] In possible implementation manners, the abnormal short message behavior detection method based on multi-dimensional feature fusion further performs the following processing: analyzing the syntax dependency tree of the short message text to extract a semantic conflict index; capturing high-frequency operation behaviors in the device operation sequence based on the semantic conflict index to generate a behavior mode encoding vector; fusing the base station positioning trajectory and IP address jump features according to the behavior mode encoding vector to construct a space-time abnormal topology graph; and performing tensor splicing on the behavior mode encoding vector and the space-time abnormal topology graph to configure the dynamic feature pool.

[0007] In possible implementation manners, the abnormal short message behavior detection method based on multi-dimensional feature fusion further performs the following processing: quantifying the distribution difference between the semantic association graph and the device behavior fingerprint by using asymmetric KL divergence, and performing quantile mutation detection of feature values within a sliding time window to configure a local outlier factor of the space-time distribution feature; mapping the time sequence features into a two-dimensional matrix through a Gram angle field transformation based on the local outlier factor of the space-time distribution feature to extract a spatial correlation feature, and the spatial correlation feature is used for dynamically correcting the edge weight of the space-time abnormal topology graph.

[0008] In a possible implementation, the method for detecting abnormal short message behaviors based on multi-dimensional feature fusion further performs the following processing: using a multi-head self-attention mechanism, performing weight allocation on the cross-modal feature sequence, and introducing a differentiable feature gating unit to filter redundant dimensions according to feature contribution degrees to obtain preliminary screening selected features; based on the preliminary screening selected features, jointly optimizing the GRU hidden state of the time sequence dependence analysis layer and the attention weight to construct a feature embedding space immune to adversarial perturbations; in the feature embedding space, determining mutual information gradients between feature channels, and combining confidence scores of the resistance sample filtering layer to generate a non-linear feature importance mask in the cascaded recognition result.

[0009] In a possible implementation, the method for detecting abnormal short message behaviors based on multi-dimensional feature fusion further performs the following processing: constructing a generative adversarial network, which is used to simulate an attacker to forge a feature distribution of a normal sample; identifying a potential adversarial sample through a confidence difference output by a discriminator, and using a feature reconstruction error and a gradient mask strategy to suppress gradient propagation of the potential adversarial sample.

[0010] In a possible implementation, the method for detecting abnormal short message behaviors based on multi-dimensional feature fusion further performs the following processing: inserting a gradient reversal layer after a last convolutional layer of the discriminator to dynamically adjust a gradient direction, so as to force an adversarial sample to form a gradient flat area in a hidden space.

[0011] In a possible implementation, the method for detecting abnormal short message behaviors based on multi-dimensional feature fusion further performs the following processing: determining a threshold baseline value according to a time decay factor of a historical abnormal event; based on the threshold baseline value, combining a current network environment risk level and user identity credibility, introducing a dynamic offset coefficient, and performing smooth updating on the dynamic abnormal probability threshold.

[0012] In a possible implementation, the method for detecting abnormal short message behaviors based on multi-dimensional feature fusion further performs the following processing: based on the center computing node, deploying an edge computing node, performing distributed feature preprocessing on the dynamic feature pool, and dynamically offloading a computing task according to a device resource state; through the offloaded computing task, configuring a lightweight detection sub-process; using the lightweight detection sub-process, establishing a local caching mechanism in the edge computing node, and the local caching mechanism is used to perform a local interception operation.

[0013] In a possible implementation, the method for detecting abnormal short message behaviors based on multi-dimensional feature fusion further performs the following processing: a behavior query index is established by using LSH (locality sensitive hashing); a context scene feature is determined based on the behavior query index, the context scene feature including a GPS trajectory cluster label and an application process CPU occupancy fluctuation; and a similarity fluctuation interval is dynamically adjusted according to the context scene feature and in combination with historical behavior baseline data, and if a similarity score does not satisfy a similarity threshold in the similarity fluctuation interval, the local interception operation is triggered.

[0014] The application further provides a system for detecting abnormal short message behaviors based on multi-dimensional feature fusion, which includes: a cross-modal feature sequence extraction module, configured to collect spatiotemporal distribution features, semantic association graphs and device behavior fingerprints of short message interactions, configure a dynamic feature pool, and extract cross-modal feature sequences by using a sliding time window to determine mutual information entropy and abnormal deviation degree among feature dimensions; a cascaded recognition module, configured to upload the mutual information entropy and the abnormal deviation degree among the feature dimensions to a central computing node for cascaded recognition, the central computing node including a feature selection layer based on an attention mechanism, a time sequence dependence analysis layer and an adversarial sample filtering layer; an abnormal probability score generation module, configured to dynamically adjust a feature fusion weight matrix according to a cascaded recognition result to generate an abnormal probability score, and trigger a multi-stage verification mechanism when the abnormal probability score exceeds a dynamic abnormal probability threshold; and an abnormal short message behavior label determination module, configured to match a time sequence mode in a historical behavior baseline of a user at an edge computing node by using the multi-stage verification mechanism, dynamically generate a verification code trigger threshold, and perform interactive risk verification in combination with context scene features to determine an abnormal short message behavior label.

[0015] The method and system for detecting abnormal short message behaviors based on multi-dimensional feature fusion collect spatiotemporal distribution features, semantic association graphs and device behavior fingerprints of short message interactions, configure a dynamic feature pool, and extract cross-modal feature sequences; perform cascaded recognition; dynamically adjust a feature fusion weight matrix to generate an abnormal probability score, and trigger a multi-stage verification mechanism when the abnormal probability score exceeds a dynamic abnormal probability threshold; match a time sequence mode at an edge computing node, dynamically generate a verification code trigger threshold, and perform interactive risk verification to determine an abnormal short message behavior label. The technical problems of single detection dimension, difficulty in identifying new complex abnormal short message behaviors, and low detection timeliness and adaptability and high false positive and false negative rates in the prior art are solved, and the technical effects of reducing false positive and false negative rates of short message anomaly detection and improving detection timeliness and adaptability are achieved. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings of the embodiments of the present disclosure will be briefly introduced below. In the present application, flowcharts are used to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the foregoing or the following operations are not necessarily performed in sequence. On the contrary, various steps can be processed in reverse order or simultaneously according to needs. At the same time, other operations can be added to these processes, or one or more steps of operations can be removed from these processes.

[0017] Figure 1 The abnormal short message behavior detection method based on multi-dimensional feature fusion provided for the embodiments of the present application is shown in the flowchart.

[0018] Figure 2 The system structure diagram of the abnormal short message behavior detection system based on multi-dimensional feature fusion provided for the embodiments of the present application is shown.

[0019] Legend: cross-modal feature sequence extraction module 10, cascaded recognition module 20, abnormal probability score generation module 30, abnormal short message behavior label determination module 40. DETAILED DESCRIPTION

[0020] The above description is only a summary of the technical solutions of the present application. In order to more clearly understand the technical means of the present application, the content of the specification can be implemented, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described.

[0021] In order to make the purposes, technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by those of ordinary skill in the art without making creative labor are within the scope of protection of the present application.

[0022] In the following description, "some embodiments" are related to a subset of all possible embodiments, however, it is to be understood that "some embodiments" can be the same subset or different subsets as other "some embodiments", and can be combined, without conflicts, with each other. The terms "first", "second", etc. are used to distinguish similar objects, and do not necessarily indicate a specific order or precedence among the objects. The terms "include", "has", and any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or server including a list of steps or units is not necessarily limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to such processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application.

[0023] The embodiments of the present application provide an abnormal short message behavior detection method based on multi-dimensional feature fusion, as shown in Figure 1 The method comprises the following steps:

[0024] In step S100, the spatiotemporal distribution features, semantic association graphs, and device behavior fingerprints of short message interactions are collected, a dynamic feature pool is configured, cross-modal feature sequences are extracted through a sliding time window, and mutual information entropy and abnormal deviation degrees between different feature dimensions are determined.

[0025] Preferably, the spatiotemporal distribution features, semantic association graphs, and device behavior fingerprints of short message interactions are collected, wherein the spatiotemporal distribution features include time distribution features and space distribution features. The time distribution features mainly include information such as time points and time intervals of short message sending and receiving. For example, a certain number frequently sends a large number of short messages in a short period of time, or abnormal short message interaction behaviors occur in a specific time period (such as non-active time in the early morning). The space distribution features refer to the geographical position information of the two parties of short message interaction. The approximate positions of the sending end and the receiving end can be obtained through the base station positioning of the mobile phone, IP address, etc. For example, the position of the short message sender suddenly crosses a large distance in a short period of time, or a large number of short messages are concentrated to a certain specific area, which reflects the characteristics of space distribution.

[0026] Preferably, the short message content is subjected to semantic analysis to construct a semantic correlation graph. Specifically, the keywords and entities (such as names, place names, and organization names) in the short message are extracted, and the relationships between them, such as inclusion, parallelism, causality, etc., are analyzed. Through the semantic correlation graph, the meaning of the short message content can be better understood, and some hidden semantic patterns can be discovered. For example, some fraudulent short messages may revolve around a specific theme (such as winning a prize, loan, etc.), and the relevant keywords and entities are mentioned multiple times in the content. Through the semantic correlation graph, such short messages with specific semantic characteristics can be more clearly identified. The device behavior fingerprint is collected. Specifically, each device will generate some unique behavior characteristics during use, which can be used as a "fingerprint" of the device, such as the model of the device, the version of the operating system, the screen resolution, sensor data (such as accelerometer and gyroscope data), network connection methods (such as Wi-Fi, 4G, 5G), etc. By collecting device-related information, a device behavior model can be established. Different device behavior patterns may reflect different usage scenarios or abnormal situations. For example, if the same account interacts with short messages from multiple devices with different behavior fingerprints within a short period of time, it may be abnormal.

[0027] Preferably, the spatiotemporal distribution characteristics, semantic correlation graph, and device behavior fingerprint of the short message are stored in a dynamic feature pool, i.e., a dynamic feature pool is configured, and is updated as new short message interaction data is continuously collected to adapt to changing short message behavior patterns. Then, a sliding time window is used to select data in the dynamic feature pool at certain time intervals. Within each time window, features of different modalities (spatiotemporal distribution, semantics, device behavior, etc.) are combined to form a cross-modal feature sequence, including the combination of the time and space information of the short message interaction, the semantic features of the short message content, and the device behavior fingerprint, etc. as a complete feature sequence, to further capture the mutual relationships and trends between different features within a period of time.

[0028] Preferably, mutual information entropy is used to measure the degree of dependence and information sharing between different feature dimensions. The higher the mutual information entropy, the closer the relationship between the two feature dimensions, and the more overlapping information contained. Specifically, for the spatiotemporal distribution features, semantic association graph, and device behavior fingerprint of short message interaction, for example, for the time feature, the time of a day can be divided into several time periods, and the frequency of short message event occurrence in each time period is counted as a probability; for the space feature, the geographic location can be divided into different regions, and the probability of short message interaction in each region is calculated, etc. First, the feature dimensions are quantized and discretized to facilitate the calculation of probability distribution, and then the joint probability distribution of the two feature dimensions and the marginal probability distribution of each are calculated. Then, the mutual information entropy of the two feature dimensions is calculated according to the formula of mutual information entropy. By calculating the mutual information entropy between the feature dimensions, it can be understood which features have a strong association, so as to better utilize these relationships to identify abnormal behavior.

[0029] Preferably, the current value of each feature dimension is compared with the historical normal value range, and the degree of deviation from the normal range, i.e. the abnormal deviation degree, is calculated to determine whether the current feature value is abnormal. If the abnormal deviation degree of a certain feature dimension is large, it means that the feature has changed in a way that is inconsistent with the normal situation, which may be an abnormal short message behavior. Specifically, first, a historical behavior baseline for each feature dimension needs to be established. For the spatiotemporal distribution features of short message interaction, the normal value range and trend of the time regularity and spatial distribution range of normal short message interaction in the past period of time are determined; for the semantic association graph, the semantic feature distribution of normal short message content is analyzed, such as the frequency of keywords, the type of semantic relationship, etc., to establish a normal semantic model; for the device behavior fingerprint, the normal value interval of each device property is determined according to the past normal use mode and behavior characteristics of the device. Then, using statistical quantities such as standard deviation or coefficient of variation, the deviation degree of the current feature value from the historical behavior baseline is calculated, and abnormal behavior is more accurately identified.

[0030] Further, step S100 further comprises step S110 of parsing the syntax dependency tree of the short message text to extract a semantic conflict index; step S120 of capturing high-frequency operation behaviors in the device operation sequence based on the semantic conflict index to generate a behavior pattern encoding vector; step S130 of fusing the base station positioning trajectory and IP address jump features according to the behavior pattern encoding vector to construct a spatiotemporal anomaly topology graph; and step S140 of tensor splicing the behavior pattern encoding vector and the spatiotemporal anomaly topology graph to configure the dynamic feature pool.

[0031] Preferably, the short message text is analyzed by natural language processing technology to determine the grammatical roles of each word in the sentence and the dependency relationship between them, such as subject-predicate-object, adverbial-complement, etc., so as to construct a syntactic dependency tree, wherein the syntactic dependency tree is a tree structure representing the grammatical relationship between words in a sentence, which can clearly show the grammatical structure of the sentence and help understand the semantics of the short message; then further analyze the semantic relationship between the words in the syntactic dependency tree, i.e. analyze and compare the semantics of the relevant words in the syntactic dependency tree, combine some predefined semantic rules and knowledge graph, and calculate the semantic conflict index of the semantic inconsistency or contradiction in the short message text, reflecting the abnormality of the short message content in the semantic level, for example, the short message mentions "I am in Shanghai, but I am also in Beijing", which will cause a higher semantic conflict index due to the contradiction in space.

[0032] Preferably, if the semantic conflict index is high, it means that the short message may be abnormal, so further analyze the relevant device operation behavior to see if there is an abnormal operation mode, specifically, record the operation of the device in the process of interacting with the short message, such as sending short messages, receiving short messages, opening short message application programs, copying, pasting, deleting short messages, etc. By analyzing the operation sequence, it is possible to determine which operations are high-frequency, for example, a device frequently sends short messages containing high semantic conflict index, or frequently deletes short messages within a short period of time, which may be related to abnormal short message behavior; then digitize the captured high-frequency operation behavior to generate a behavior pattern coding vector, wherein each element may represent a specific operation behavior or a certain feature of the operation behavior, and further convert the operation behavior pattern of the device into a digital vector that can be processed and analyzed by a computer.

[0033] Preferably, based on the generated behavior pattern encoding vector, the base station positioning trajectory and the IP address jump feature are fused. Specifically, by means of signal interaction between the mobile phone and the base station, the approximate geographic location information of the device is obtained to form the base station positioning trajectory, and then the geographic location change of the device when sending and receiving the short message is analyzed, for example, whether there is a large-scale location movement in a short time or whether it appears in some abnormal geographic location; the IP address change when the device performs the short message related network operation is observed, and if the IP address frequently jumps between different network segments or geographic locations, it indicates that the device has abnormal network behavior, such as being used for illegal short message mass sending or network attack; then the operation behavior feature represented by the behavior pattern encoding vector is combined with the base station positioning trajectory and the IP address jump feature to construct a space-time abnormal topology graph in a graphical manner, wherein the nodes can represent different devices, geographic locations or operation behaviors, and the edges represent the relationship between these elements, such as the association between the device and the geographic location, the relationship between the operation behavior and the IP address change, etc. Through the space-time abnormal topology graph, the abnormal behavior pattern and relationship of the device in the space-time dimension can be intuitively displayed to help discover potential abnormal short message behavior.

[0034] Preferably, the behavior pattern encoding vector and the space-time abnormal topology graph are tensor spliced, that is, the behavior pattern encoding vector and the space-time abnormal topology graph are converted into tensor form, and then spliced according to certain rules, wherein the tensor is a mathematical structure that can represent multi-dimensional data, for example, the behavior pattern encoding vector is taken as a one-dimensional tensor, and the space-time abnormal topology graph is taken as a two-dimensional or higher-dimensional tensor, and then they are spliced in dimension to form a comprehensive tensor containing device operation behavior and space-time features, and then different types and dimensions of features are integrated; finally, the spliced tensor is stored in the dynamic feature pool, and new feature tensors can be continuously updated and added as new short message data and device operation data arrive; at the same time, the existing data in the feature pool can also be updated and deleted to ensure that the data in the feature pool can timely reflect the latest device behavior and short message interaction, which is helpful for accurate short message anomaly detection and analysis.

[0035] Further, step S140 further includes step S141 of quantifying the distribution difference between the semantic association graph and the device behavior fingerprint by using asymmetric KL divergence, and performing quantile mutation detection of feature values in a sliding time window to configure a local outlier factor of the space-time distribution feature; and step S142 of mapping the time sequence feature to a two-dimensional matrix by Gram angle field transformation based on the local outlier factor of the space-time distribution feature to extract a spatial correlation feature, wherein the spatial correlation feature is used for dynamically correcting the edge weight of the space-time abnormal topology graph.

[0036] Preferably, the asymmetric KL divergence is used to quantify the distribution difference between the semantic correlation graph and the device behavior fingerprint, where the KL divergence, also known as relative entropy, is used to measure the difference between two probability distributions. Specifically, the semantic correlation graph and the device behavior fingerprint are each regarded as a probability distribution, and the asymmetric KL divergence indicates that the direction of calculation is different, i.e. the divergence from the semantic correlation graph to the device behavior fingerprint may be different from the divergence from the device behavior fingerprint to the semantic correlation graph. By calculating the KL divergence value, the difference between the two features in the distribution is quantified. For example, if the probability distribution of some semantic features in the semantic correlation graph is significantly different from the probability distribution of related features in the device behavior fingerprint, the KL divergence value will be larger, indicating that the difference between the two is significant, indicating that the short message has abnormal behavior. Then use the sliding time window method to operate on the time series data, i.e. calculate the quantile (such as median, quartile, etc.) in each time window, and the quantile mutation detection is to observe the changes of these quantiles between different time windows. If a certain quantile is found to have a large mutation at a certain time (compared with the historical trend), it is considered that there may be an abnormal situation.

[0037] Preferably, finally, the local outlier factor of each spatiotemporal distribution feature data point is configured by combining the above quantile mutation detection, etc., to better identify abnormal situations in the spatiotemporal dimension. Specifically, for the spatiotemporal distribution feature, the local outlier factor value of each data point is determined by calculating the density ratio of each data point relative to its neighborhood points, where the local outlier factor is used to detect whether a data point is an outlier. If the local outlier factor value of a data point is significantly greater than 1, it means that the density difference between it and the surrounding neighborhood points is large, and it is likely to be an outlier, i.e. the spatiotemporal distribution feature may have an anomaly.

[0038] Preferably, for the time sequence features related to the spatio-temporal distribution (such as position change on the time sequence, time interval change, etc.), the Gram angle field (GAF) transformation is used to map them into a two-dimensional matrix, wherein the Gram angle field transformation is used to convert the time sequence data into a two-dimensional image (matrix form), which can preserve the important features of the time sequence and present the distribution and relationship of the data from the spatial angle, and the elements in the two-dimensional matrix reflect certain association and features between different time points; then the spatial correlation features of the two-dimensional matrix are extracted by calculating the statistical quantities and eigenvalues in the matrix, which reflect the internal relationship of the spatio-temporal distribution in the spatial dimension, such as the moving pattern of the device between different positions, the correlation of the position change, etc.; finally, according to the extracted spatial correlation features, the weights of the edges in the spatio-temporal anomaly topology graph are dynamically corrected, for example, if it is found that the spatial correlation between certain positions is strong, the weight of the edge connecting these positions in the topology graph can be increased accordingly; on the contrary, if the correlation is weak, the weight can be reduced; thereby the topology graph can more accurately reflect the real relationship and abnormal situation of the device in the spatio-temporal dimension, thereby improving the accuracy and reliability of the anomaly detection.

[0039] In step S200, the mutual information entropy and the abnormal deviation degree between the feature dimensions are uploaded to a central computing node for cascaded identification, the central computing node comprising a feature selection layer based on an attention mechanism, a time sequence dependence analysis layer and an adversarial sample filtering layer.

[0040] Preferably, the mutual information entropy and the abnormal deviation degree between the feature dimensions are uploaded to a central computing node, wherein the central computing node is a unit with strong computing power and centralized processing function, responsible for receiving data from each collection point or preprocessing module and performing calculation processing to realize the evaluation and anomaly detection of the short message; the cascaded identification is a kind of identification mode which is carried out in stages and step by step, through the successive processing of multiple levels or modules, the input data is deeply analyzed and identified to improve the accuracy and reliability of the identification, specifically, the data successively passes through different functional layers in the central computing node, each layer has its specific task and function, and together completes the comprehensive analysis of the mutual information entropy and the abnormal deviation degree, so as to identify the possible abnormal situation or mode.

[0041] Preferably, the central computing node comprises an attention mechanism-based feature selection layer, a time series dependency analysis layer, and an adversarial sample filtering layer. The attention mechanism refers to a mechanism that simulates human visual attention, allowing the model to automatically focus on the most important parts of the input data. In processing multi-dimensional feature data such as mutual information entropy and abnormal deviation degree, the attention mechanism can help the model dynamically allocate weights to different features, highlighting features that contribute more to the final recognition result and weakening less important features. The feature selection layer can use the attention mechanism to select a subset of features that are most representative and discriminative from a large number of feature dimensions. For example, among multiple mutual information entropy and abnormal deviation degree features, some features may be more closely related to abnormal behavior. The feature selection layer can select these key features to reduce subsequent computational load while improving the model's ability to recognize abnormal situations.

[0042] Preferably, there may be some dependency relationship between mutual information entropy and abnormal deviation degree data in time series, i.e., the current feature value may be related to the past or future feature value. For example, abnormal deviation degree may exhibit a certain trend or periodic change over time, or there may be continuous abnormal fluctuations within a certain time period. The time series dependency analysis layer mainly uses time series analysis models such as recurrent neural networks (RNN), long short-term memory networks (LSTM), etc., to model feature data in the time dimension, capturing long-term and short-term dependency information in the data, and better understanding the changing patterns of features over time, discovering potential abnormal patterns such as sudden abnormal trends or feature fluctuations that do not conform to historical patterns, and thus more accurately identifying the time and pattern of abnormal behavior.

[0043] Preferably, adversarial samples are samples generated by carefully designed minor perturbations on normal samples, which may cause the model to produce incorrect prediction results, but still appear to be normal samples to humans. There may be some malicious attacks trying to interfere with the normal operation of the system by generating adversarial samples, or some abnormal data similar to adversarial samples may be generated due to some abnormal situations in the data collection and processing process. The adversarial sample filtering layer usually uses adversarial sample detection and defense techniques such as GAN-based detection to re-examine the data processed by the feature selection layer and the time series dependency analysis layer, to identify and filter out adversarial samples or abnormal data, to ensure the accuracy and reliability of the final recognition result, and to prevent the model from being misled to produce incorrect judgments.

[0044] Further, step S200 further comprises step S210 of using a multi-head self-attention mechanism to perform weight allocation on the cross-modal feature sequence, and introducing a differentiable feature gating unit to filter redundant dimensions according to feature contribution to obtain pre-screening selection features; step S220 of jointly optimizing the GRU hidden state of the time series dependence analysis layer and the attention weight based on the pre-screening selection features to construct a feature embedding space immune to adversarial perturbations; and step S230 of determining mutual information gradients between feature channels in the feature embedding space and combining the confidence score of the resistance sample filtering layer to generate a nonlinear feature importance mask in the cascaded recognition result.

[0045] Preferably, the multi-head self-attention mechanism allows the model to capture the relationship between features in different representation subspaces. For a cross-modal feature sequence (a sequence composed of different modal feature combinations such as spatiotemporal distribution features of short message interactions, semantic association graphs, and device behavior fingerprints), the multi-head self-attention mechanism calculates the attention scores of multiple heads in parallel, each head capturing the dependency between features from a different perspective, then concatenating or weighting the results, and further assigning corresponding weights to each feature element in the cross-modal feature sequence, highlighting those more important parts of the overall feature representation. For example, when processing a combined sequence of spatiotemporal distribution features and semantic features, the multi-head self-attention mechanism can identify that semantic features may be more critical to determining abnormalities in certain cases, thereby giving higher weights to semantic features.

[0046] Preferably, the differentiable feature gating unit is introduced to filter redundant dimensions according to feature contribution, wherein the differentiable feature gating unit can control whether a feature dimension passes according to the contribution of the feature, i.e., according to the weight of each feature dimension and other related information (such as the variance and information entropy of the feature), a gating value is calculated. If the gating value of a certain feature dimension is low, it means that the dimension contributes less to the overall feature representation and may be redundant, so the gating unit will reduce the weight of the dimension or directly filter it out, thereby reducing the number of feature dimensions, removing redundant information, improving the computational efficiency and generalization ability of the model, and ultimately obtaining pre-screening selection features.

[0047] Preferably, based on the pre-screening selection features obtained by the multi-head self-attention mechanism and the differentiable feature gating unit, specifically, the time-dependent analysis layer uses a gated recurrent unit (GRU) to process the time series data, which outputs an implicit state at each time step, containing sequence information up to the current time, and the GRU implicit state of the time-dependent analysis layer is jointly optimized with the attention weight, that is, the parameters of the GRU and the parameters in the attention mechanism are adjusted at the same time, so that the implicit state of the GRU can better capture the information related to the important features emphasized by the attention weight, and can better reflect the time-dependent relationship between features, for example, when the attention weight highlights a certain semantic feature, the implicit state of the GRU can also effectively encode and remember the feature accordingly; the feature embedding space immune to adversarial perturbations is constructed by joint optimization, which can better maintain the semantic and time sequence information of the features, and has stronger immunity to some malicious adversarial perturbations (such as minor modifications or added noise to feature data), so that the model can still accurately identify and classify features when facing these perturbations, wherein the feature embedding space is a low-dimensional vector space that maps features into, in which similar features are close and different features are separated.

[0048] Preferably, in the constructed feature embedding space, the features can be regarded as composed of multiple channels (similar to the RGB channels in images), by calculating the mutual information gradient between the feature channels, that is, the rate and direction of information change between different feature channels, it can be understood which channels have more frequent and important information interaction, and how information flows between channels, for example, a certain feature channel has a large mutual information gradient, indicating that it has close information exchange with other channels and makes a greater contribution to the overall feature representation; the resistance sample filtering layer performs confidence assessment on the input samples and gives a confidence score reflecting the possibility of whether the sample is a normal sample or an abnormal sample; then the mutual information gradient between the feature channels and the confidence score of the resistance sample filtering layer are combined to comprehensively consider the importance of information interaction of the features and the overall abnormality possibility of the samples, and finally a nonlinear feature importance mask is generated, that is, a vector corresponding to the feature dimension, wherein the value of each element represents the importance degree of the feature dimension. The value of each element in the mask is determined by the mutual information gradient and the confidence score in a nonlinear way (such as using an activation function, etc.), which is used to screen and emphasize the more important features for the final cascaded recognition result, helping the model to make more accurate judgments, such as identifying abnormal short message behaviors.

[0049] Further, step S200 further comprises step S240 of constructing a generative adversarial network for simulating an attacker to forge a feature distribution of normal samples; and step S250 of identifying potential adversarial samples through a confidence difference output by a discriminator and suppressing gradient propagation of the potential adversarial samples by using a feature reconstruction error and a gradient mask strategy.

[0050] Preferably, the generative adversarial network comprises a generator and a discriminator, the generator is configured to generate a forged sample similar to a real sample, and the discriminator is configured to distinguish the real sample and the forged sample generated by the generator, the generative adversarial network is configured to simulate an attacker to forge a feature distribution of normal samples, specifically, the generator is configured to simulate an attacker to forge normal samples, the attacker may try to modify or forge normal samples to make them look like normal short message interaction behavior samples, so as to bypass the anomaly detection system, the generator learns a feature distribution of real normal samples (such as samples composed of features such as spatiotemporal distribution features, semantic correlation graph, and device behavior fingerprint of normal short message interaction), and generates a forged sample as realistic as possible, the forged sample has a similar feature mode to the real normal sample, but is actually created by the generator, the generator is continuously trained to enable it to accurately simulate the forging manner that may be adopted by the attacker, so as to better understand the potential attack means and the generation mechanism of abnormal samples.

[0051] Preferably, after receiving the samples (including real samples and fake samples generated by the generator), the discriminator evaluates the samples and outputs a confidence score indicating the likelihood that the sample is a real sample. For real normal samples, the discriminator should output a higher confidence score; for fake samples (i.e., potential adversarial samples), the discriminator's confidence score should be lower. By comparing the differences in confidence scores output by the discriminator for different samples, potential adversarial samples that may have been forged by attackers can be identified, for example, if a sample's confidence score is significantly lower than that of other normal samples, it may be a potential adversarial sample. Then, the authenticity of the sample is further verified by calculating its feature reconstruction error, which refers to the difference between the original sample features and the reconstructed features (e.g., by using an autoencoder or other methods). If the sample is normal, its features should be accurately reconstructed, resulting in a small reconstruction error. For adversarial samples, since their features may be tampered or forged by attackers, the reconstruction error may be larger. By setting a reconstruction error threshold, the true adversarial samples can be further filtered out. Then, a gradient masking strategy is used to prevent adversarial samples from having a negative impact on model parameter updates (e.g., misleading the model to learn incorrect feature patterns). Specifically, gradient masking refers to suppressing or masking the gradient of potential adversarial samples when calculating the gradient. Specifically, based on the confidence score or reconstruction error of the sample, a gradient mask value is assigned to each sample. If a sample is considered a potential adversarial sample, its gradient mask value can be set to a low value, thereby reducing the impact of the sample on the model during parameter updates, allowing the model to more robustly learn the feature patterns of real samples and improve the model's detection ability for abnormal samples and defense capability against adversarial attacks.

[0052] Further, step S250 further includes inserting a gradient reversal layer after the last convolutional layer of the discriminator to dynamically adjust the gradient direction and force the adversarial samples to form a gradient flat area in the latent space.

[0053] Preferably, a gradient reversal layer is inserted after the last convolutional layer of the discriminator, where the gradient reversal layer is a special neural network layer that operates on the gradient during model training. During forward propagation, the data passes through the layer normally and the forward calculation is performed normally. However, during backward propagation, the direction of the gradient is reversed, i.e., the original gradient is multiplied by -1. When calculating the gradient of the adversarial sample, the gradient direction of the adversarial sample is dynamically adjusted due to the gradient reversal layer, and the gradient of the adversarial sample propagates in the opposite direction compared to the gradient direction of the normal sample. This facilitates the discriminator to process the adversarial sample and the normal sample differently, allowing the discriminator to better distinguish between the two types of samples.

[0054] Preferably, the gradient propagation mode of the adversarial sample in the latent space is changed by gradient reversal. Normally, the model updates the parameters by gradient descent to optimize the model in the direction of reducing the loss function. However, for the adversarial sample, after gradient reversal, the gradient of the adversarial sample will guide the model parameters to develop in the direction of making the features of the adversarial sample in the latent space more "fuzzy" or "flat". This indicates that the representation of the adversarial sample in the latent space will gradually become indistinguishable, forming a gradient flat area. At this time, the features of the adversarial sample will not have a great impact on the parameter update of the model, thereby reducing the interference of the adversarial sample on the model and improving the robustness of the model and the classification accuracy of normal samples. At the same time, it is helpful for the model to better learn the features of normal samples so as to more accurately identify abnormal behaviors.

[0055] In step S300, the feature fusion weight matrix is dynamically adjusted according to the cascaded recognition result to generate an abnormal probability score. When the abnormal probability score exceeds a dynamic abnormal probability threshold, a multi-stage verification mechanism is triggered.

[0056] Preferably, the feature fusion weight matrix is dynamically adjusted according to the cascaded recognition result. Specifically, if it is found that certain features play a key role in accurately identifying abnormal behaviors, the weight values of these features in the weight matrix are correspondingly increased. Conversely, if certain features have less contribution to the recognition result or even may lead to misjudgment, their weight values are reduced. This further makes the feature fusion more reasonable, can better highlight the information valuable for abnormal detection, and improves the accuracy and adaptability of detection. For example, in a certain cascaded recognition, it is found that the semantic association graph feature is very crucial for identifying fraudulent short message abnormal behaviors. Therefore, the weight of the semantic association graph feature in the weight matrix is increased. Then, the collected multi-dimensional features (such as the spatiotemporal distribution features of short message interaction, semantic association graph, device behavior fingerprint, etc.) are fused according to the adjusted weight matrix to obtain a feature vector, and a probability value representing that the sample is an abnormal sample, i.e. an abnormal probability score, is calculated. The abnormal probability score reflects the possibility of the sample belonging to abnormal behaviors according to the current feature fusion and model judgment. For example, an abnormal probability score of 0.8 indicates that the sample has an 80% possibility of being an abnormal sample. The dynamic abnormal probability threshold is set according to the distribution characteristics of the data and the requirements of detection. Specifically, in different time periods (such as peak and valley periods of business), the normal mode of short message behaviors may be different, and the abnormal probability threshold is correspondingly adjusted. Or according to the statistical analysis of historical detection data, when it is found that the false positive rate or the false negative rate is too high, the threshold is adjusted. When the calculated abnormal probability score exceeds the current dynamic abnormal probability threshold, it indicates that the sample has a high possibility of being an abnormal sample. Therefore, the multi-stage verification mechanism is triggered to confirm whether the sample really belongs to abnormal behaviors, so as to reduce the false positive and false negative situations and improve the reliability of abnormal detection.

[0057] Further, step S300 further comprises step S310, determining a threshold baseline value according to a time decay factor of historical abnormal events; step S320, based on the threshold baseline value, combining the current network environment risk level and the user identity credibility, introducing a dynamic offset coefficient, and performing a smooth update on the dynamic abnormal probability threshold.

[0058] Preferably, the relevant data of historical abnormal events, including occurrence time, event type, impact degree, etc., are obtained from historical records, and an event decay factor of historical abnormal events is determined, wherein the time decay factor is usually a value between 0 and 1, which is used to measure the influence of historical abnormal events on the determination of the current threshold value over time. Generally speaking, the more recent the abnormal event, the greater the current influence, and as time goes by, the influence of past abnormal events gradually weakens. For example, assuming that the time decay factor is 0.9, the influence of historical abnormal events will be multiplied by 0.9 every unit time from now on, gradually becoming smaller. Then the historical abnormal events are weighted and summed according to the time decay factor to determine the threshold baseline value. For example, the severity of abnormal events occurring at different time points in the past is multiplied by the corresponding time decay factor and then added to obtain a comprehensive value, which is taken as the threshold baseline value.

[0059] Preferably, the security and stability of the network environment changes over time, and the risk level is evaluated according to various risk factors existing in the current network (such as network attack frequency, number of vulnerabilities, network traffic anomaly, etc.), wherein the risk level can be represented by different levels, such as low, medium, and high. For example, when there are a large number of malicious attack attempts in the network, the network environment risk level is rated as high. The credibility of the user's identity is evaluated according to the user's historical behavior records, the strength of the identity authentication method, and whether there is abnormal login behavior, etc., to obtain the user identity credibility, which may have a value range of 0 to 1, and the higher the value, the higher the credibility. For example, a user who has a long-term stable login through a strong identity authentication method and has no abnormal behavior record has a high identity credibility. Then the dynamic offset coefficient is determined according to the current network environment risk level and the user identity credibility. Generally speaking, the higher the network environment risk level, the larger the dynamic offset coefficient, so that the threshold is adjusted to a lower direction to detect abnormalities more sensitively; and the higher the user identity credibility, the smaller the dynamic offset coefficient, so that the threshold is relatively stable or adjusted to a higher direction to avoid misjudgment of normal behavior of a trusted user as abnormal.

[0060] Preferably, the dynamic offset coefficient is combined with a threshold baseline value to update the dynamic anomaly probability threshold through certain calculation methods (such as multiplication or addition, etc.). Specifically, to avoid drastic changes in the threshold value, a smoothing update method is usually used, that is, the amplitude of each update is not too large, so that the threshold value can gradually adjust with the changes in network environment and user situation, maintaining the accuracy and stability of detection. For example, assuming that the threshold baseline value is 0.6 and the dynamic offset coefficient is 0.8, the updated dynamic anomaly probability threshold is 0.6 x 0.8 = 0.48, but in actual operation, it may not be directly updated to 0.48, but according to the smoothing update strategy, it gradually approaches 0.48, such as updating 0.05 each time, and after multiple updates, it reaches a value close to 0.48.

[0061] In step S400, the multi-stage verification mechanism is used to match the timing pattern in the user historical behavior baseline at the edge computing node, dynamically generate a verification code trigger threshold, and conduct interactive risk verification combined with context scene features to determine the abnormal short message behavior label.

[0062] Preferably, the multi-stage verification mechanism is used to improve verification accuracy and security, which usually includes multiple verification steps or stages that are performed in sequence, and the results of the previous stage will affect the execution of the subsequent stage. Through step-by-step in-depth verification, the authenticity of related behaviors or events can be more comprehensively evaluated and judged. Specifically, the timing pattern in the user historical behavior baseline is matched at the edge computing node to determine whether the user behavior is consistent with the previous pattern. If the current behavior deviates greatly from the historical timing pattern, it may indicate an abnormal situation. The edge computing node is a computing node close to the data source or user end, which can perform local data processing and analysis, reducing data transmission delay and dependence on the cloud. The user historical behavior baseline includes various behavior characteristics of the user in a period of time, such as operation time, operation frequency, operation type, etc. The timing pattern refers to the pattern of user behavior in time series, for example, the user usually sends short messages at a specific time period every day, or performs a certain operation at a certain time interval. According to the timing pattern in the user historical behavior baseline and other related factors (such as the current network environment, recent security events, etc.), a verification code trigger threshold is generated. For example, if the user's behavior is basically consistent with the historical timing pattern and the current network environment is safe, the verification code trigger threshold may be relatively high, that is, it is not easy to trigger the verification code verification. However, if the user's behavior shows some abnormal signs, such as the operation time deviates significantly from the regular, or the recent network environment has security risks, the verification code trigger threshold is lowered to timely verify the user's identity and behavior through the verification code verification.

[0063] Preferably, the interaction verification and risk assessment are performed by combining user behavior information (such as whether it meets the timing pattern, whether it triggers the verification code, etc.) with context scenario features, which include various background information related to the current behavior, such as the content of the message, the object of sending, the geographic location, device information, etc. For example, if a user sends a message at an atypical time and the message content contains sensitive information, and the sending object is an unusual number, a comprehensive analysis is performed to determine the risk level of the behavior, which may include requiring the user to perform additional verification operations, such as answering some questions related to the context scenario, or confirming the user's identity through other interactive methods, to verify whether there is an abnormal risk. After multiple stages of verification, matching, dynamic threshold judgment, and interactive risk verification, it is determined whether to mark the current message behavior as abnormal according to the final evaluation result. If the comprehensive analysis finds that the behavior has a high risk and does not meet the user's historical behavior pattern, and the context scenario features are also abnormal, the message behavior is marked as an abnormal message behavior to protect the security of the system and the interests of the user.

[0064] Further, step S400 further includes step S410, deploying edge computing nodes based on the center computing node, performing distributed feature preprocessing on the dynamic feature pool, and dynamically offloading computing tasks according to device resource states; step S420, configuring a lightweight detection sub-process through the offloaded computing tasks; and step S430, using the lightweight detection sub-process to establish a local caching mechanism at the edge computing node, which is used to perform a local interception operation.

[0065] Preferably, the edge computing nodes are deployed based on the center computing node, that is, a plurality of edge computing nodes are set at the network edge close to the data source or user with the center computing node as the core, so that part of the computing tasks can be sunk from the center computing node to the edge computing nodes, reducing data transmission delay and improving the response speed and processing efficiency of the system. Then, the plurality of edge computing nodes are used to preprocess the data in the dynamic feature pool, and each edge computing node is responsible for processing a part of the feature data. Through local data cleaning, screening, key feature extraction, etc., the original and complex feature data are converted to reduce the computing burden of the center computing node, and the local processing capability of the edge computing node can also be used to preliminarily process the feature data faster. Each edge computing node has its own device resource limitations, such as computing capability, memory, storage, etc. According to the real-time state of the device resources, it is dynamically decided whether to offload some computing tasks from the current edge computing node to other nodes or the center computing node. For example, when the CPU usage of a certain edge computing node is too high or the memory is insufficient, some non-urgent computing tasks are transferred to other nodes for execution to ensure timely processing of the computing tasks.

[0066] Preferably, in the process of unloading computing tasks, the detection process is optimized and adjusted according to actual conditions to form a lightweight detection sub-process to adapt to the requirements of edge computing nodes in a resource-limited situation, while ensuring the detection and processing capacity of key information, without affecting the identification and response to abnormal situations; then, using the configured lightweight detection sub-process, a local cache mechanism is established on the edge computing node to temporarily store some frequently accessed (such as feature data, model parameters, historical detection results, etc.) or processed data locally to quickly access the next time, reducing the access frequency to remote data storage or central computing nodes, when a new detection task arrives, first look for related information from the local cache, if it exists, directly use, without the need to retrieve from remote or recalculate, thereby improving response speed and saving computing resources; the local cache mechanism is also used to perform local interception operations, specifically, when the edge computing node receives data or requests, first check and judge through the local cache mechanism, if some data or requests meet certain interception conditions, such as matching with known abnormal features or blacklist information in the cache, the edge computing node can directly intercept and process it locally, which can quickly prevent potential dangerous or abnormal data, improve security and processing efficiency.

[0067] Further, step S430 further comprises step S431, using LSH local sensitive hashing to establish a behavior query index; step S432, based on the behavior query index, determining context scene features, the context scene features including GPS trajectory clustering labels, application process CPU occupancy rate fluctuations; step S433, according to the context scene features, combining historical behavior baseline data, dynamically adjusting the similarity fluctuation interval, if the similarity score does not meet the similarity threshold limit under the similarity fluctuation interval, triggering the local interception operation.

[0068] Preferably, the LSH local sensitive hashing is used to establish the behavior query index, wherein the LSH local sensitive hashing can map similar data into similar hash buckets, and when processing the behavior data, the short message interaction behavior data can be mapped into the same or similar hash values according to the feature similarity, specifically, the behavior data of the user or the device is processed by the LSH local sensitive hashing, and the hash mapping is performed according to the similarity of the short message sending time, the sending frequency, the receiving object and the like, so as to construct the behavior query index, when it is needed to query other behaviors similar to a specific behavior, the behavior query index is used to quickly locate to the similar behavior data set, and the query efficiency is greatly improved; then the data of the behavior query index is analyzed to determine the context scene features, specifically including the GPS trajectory clustering label and the application process CPU occupancy fluctuation, wherein the GPS trajectory data corresponding to the related behavior is found through the behavior query index, the GPS trajectory data of the device is analyzed, similar trajectories are divided into the same category, and each category is given a label, the GPS trajectory clustering label is obtained to reflect the movement mode of the device in different time periods or different regions; the CPU occupancy of the application process running on the device is monitored, and the fluctuation change before and after the behavior is analyzed, different behaviors can cause different application process CPU occupancy fluctuation modes, for example, sending a large number of short messages can cause the CPU occupancy of the short message application process to increase, and some malicious software behaviors can cause abnormal CPU occupancy fluctuation.

[0069] Preferably, the contextual scene features are compared with the historical behavior baseline data, and the similarity fluctuation range, which represents the acceptable range of similarity between the current behavior and the historical normal behavior, is dynamically adjusted according to the difference between the two and other related factors (such as time change, environmental change, etc.). For example, if the current environment is relatively stable and the user behavior pattern changes little, the similarity fluctuation range may be relatively narrow; if there are large changes in the current environment or some new situations occur in the user behavior, the similarity fluctuation range may be appropriately relaxed. The similarity between the contextual scene features of the current behavior and the historical behavior baseline data is calculated by cosine similarity, Euclidean distance, etc. to obtain a similarity score, which reflects the similarity between the current behavior and the historical normal behavior. Then, the similarity threshold limit under the similarity fluctuation range is compared, wherein the similarity threshold limit is used to judge whether the similarity score is within the acceptable range. Specifically, if the calculated similarity score does not meet the similarity threshold limit under the similarity fluctuation range, i.e. the similarity between the current behavior and the historical normal behavior exceeds the acceptable range, it means that the current behavior may be abnormal, and the edge computing node triggers a local interception operation to prevent the behavior from continuing, so as to prevent possible security risks or abnormal situations from occurring, i.e. when the similarity score between the contextual scene features of the short message sending behavior and the historical behavior baseline data is too low and does not meet the set similarity threshold limit, the sending operation of the short message is intercepted.

[0070] In the foregoing, with reference to Figure 1 The abnormal short message behavior detection method based on multi-dimensional feature fusion according to the embodiments of the present application is described in detail. Next, with reference to Figure 2 The abnormal short message behavior detection system based on multi-dimensional feature fusion according to the embodiments of the present application will be described.

[0071] The abnormal short message behavior detection system based on multi-dimensional feature fusion according to the embodiments of the present application is used to solve the technical problems of single detection dimension, difficulty in identifying new complex abnormal short message behaviors, and high false positive and false negative rates in the prior art, thereby achieving the technical effects of reducing the false positive and false negative rates of short message anomaly detection and improving the detection timeliness and adaptability. As shown in Figure 2 The abnormal short message behavior detection system based on multi-dimensional feature fusion includes a cross-modal feature sequence extraction module 10, a cascaded recognition module 20, an abnormal probability score generation module 30, and an abnormal short message behavior label determination module 40.

[0072] The cross-modal feature sequence extraction module 10 is configured to collect the spatiotemporal distribution features, semantic association graphs, and device behavior fingerprints of short message interactions, configure a dynamic feature pool, and extract cross-modal feature sequences through a sliding time window to determine mutual information entropy and abnormal deviation degree between feature dimensions. The cross-modal feature sequence extraction module 10 is configured to collect the spatiotemporal distribution features, semantic association graphs, and device behavior fingerprints of short message interactions, configure a dynamic feature pool, and extract cross-modal feature sequences through a sliding time window to determine mutual information entropy and abnormal deviation degree between feature dimensions. The cross-modal feature sequence extraction module 10 is configured to collect the spatiotemporal distribution features, semantic association graphs, and device behavior fingerprints of short message interactions, configure a dynamic feature pool, and extract cross-modal feature sequences through a sliding time window to determine mutual information entropy and abnormal deviation degree between feature dimensions.

[0073] In the following, the specific configuration of the cross-modal feature sequence extraction module 10 will be described in detail. The cross-modal feature sequence extraction module 10 further comprises: parsing the syntax dependency tree of the short message text to extract a semantic conflict index; based on the semantic conflict index, capturing high-frequency operation behaviors in the device operation sequence to generate a behavior pattern encoding vector; according to the behavior pattern encoding vector, fusing base station positioning trajectories and IP address jump features to construct a spatiotemporal anomaly topology graph; and performing tensor splicing on the behavior pattern encoding vector and the spatiotemporal anomaly topology graph to configure the dynamic feature pool.

[0074] In the following, the specific configuration of the cross-modal feature sequence extraction module 10 will be described in detail. The cross-modal feature sequence extraction module 10 further comprises: adopting asymmetric KL divergence to quantify the distribution difference between the semantic association graph and the device behavior fingerprint, and performing quantile mutation detection of feature values within a sliding time window to configure a local outlier factor of spatiotemporal distribution features; based on the local outlier factor of spatiotemporal distribution features, mapping the time series features into a two-dimensional matrix through a Gram angle field transformation to extract spatial correlation features, which are used for dynamic edge weight correction of the spatiotemporal anomaly topology graph.

[0075] Below, the specific configuration of the cascaded recognition module 20 will be described in detail. The cascaded recognition module 20 further comprises: using a multi-head self-attention mechanism, performing weight allocation on the cross-modal feature sequence, and introducing a differentiable feature gating unit to filter redundant dimensions according to feature contribution, to obtain pre-screening selection features; based on the pre-screening selection features, jointly optimizing the GRU hidden state of the time sequence dependence analysis layer and the attention weight, to construct a feature embedding space immune to perturbation; in the feature embedding space, determining the mutual information gradient between feature channels, and combining the confidence score of the resistance sample filtering layer, to generate a non-linear feature importance mask in the cascaded recognition result.

[0076] Below, the specific configuration of the cascaded recognition module 20 will be described in detail. The cascaded recognition module 20 further comprises: constructing a generative adversarial network, which is used to simulate an attacker to forge the feature distribution of normal samples; identifying potential adversarial samples through the confidence difference output by the discriminator, and using feature reconstruction error and gradient mask strategy to suppress the gradient propagation of the potential adversarial samples.

[0077] Below, the specific configuration of the cascaded recognition module 20 will be described in detail. The cascaded recognition module 20 further comprises: inserting a gradient reversal layer after the last convolutional layer of the discriminator, dynamically adjusting the gradient direction, and forcing the adversarial samples to form a gradient flat area in the hidden space.

[0078] Below, the specific configuration of the abnormal probability score generation module 30 will be described in detail. The abnormal probability score generation module 30 further comprises: determining a threshold baseline value according to a time decay factor of historical abnormal events; based on the threshold baseline value, combining the current network environment risk level and the user identity trustworthiness, introducing a dynamic offset coefficient, and performing smooth updating on the dynamic abnormal probability threshold.

[0079] Below, the specific configuration of the abnormal short message behavior label determination module 40 will be described in detail. The abnormal short message behavior label determination module 40 further comprises: based on the central computing node, deploying an edge computing node, performing distributed feature preprocessing on the dynamic feature pool, and dynamically offloading computing tasks according to device resource state; through the offloaded computing tasks, configuring a lightweight detection sub-process; using the lightweight detection sub-process, establishing a local caching mechanism in the edge computing node, which is used to perform local interception operations.

[0080] Below, the specific configuration of the abnormal short message behavior label determination module 40 will be described in detail. The abnormal short message behavior label determination module 40 further comprises: establishing a behavior query index by using LSH local sensitive hashing; determining context scene features based on the behavior query index, the context scene features comprising GPS trajectory cluster labels and application process CPU occupancy rate fluctuations; dynamically adjusting a similarity fluctuation interval according to the context scene features and in combination with historical behavior baseline data, and triggering the local interception operation if a similarity score does not satisfy a similarity threshold limit under the similarity fluctuation interval.

[0081] The abnormal short message behavior detection system based on multi-dimensional feature fusion provided by the embodiments of the present application can execute the abnormal short message behavior detection method based on multi-dimensional feature fusion provided by any of the embodiments of the present application, and has the corresponding functional modules and beneficial effects of the execution method.

[0082] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, however, any number of different modules can be used and run on the user terminal and / or server, and the various units and modules are only divided according to the functional logic, but are not limited to the above division, as long as the corresponding functions can be realized; in addition, the specific names of the functional units are only for the convenience of mutual differentiation, and do not limit the protection scope of the present application.

[0083] The above specific embodiments do not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. An abnormal short message behavior detection method based on multi-dimensional feature fusion, characterized in that, Comprise: Collect the spatiotemporal distribution characteristics, semantic association graph and device behavior fingerprint of short message interaction, configure a dynamic feature pool, and extract cross-modal feature sequences through a sliding time window to determine the mutual information entropy and abnormal deviation degree between each feature dimension; Upload the mutual information entropy and abnormal deviation degree between each feature dimension to the central computing node for cascaded identification, which includes a feature selection layer based on attention mechanism, a time series dependence analysis layer and an adversarial sample filtering layer; According to the cascaded identification result, dynamically adjust the feature fusion weight matrix to generate an abnormal probability score, and when the abnormal probability score exceeds the dynamic abnormal probability threshold, trigger the multi-stage verification mechanism; Using the multi-stage verification mechanism, match the time series pattern in the user historical behavior baseline on the edge computing node, dynamically generate a verification code trigger threshold, and combine the context scene features for interactive risk verification to determine the abnormal short message behavior label; Wherein, collecting the spatiotemporal distribution characteristics, semantic association graph and device behavior fingerprint of short message interaction, configuring a dynamic feature pool, comprises: Parse the syntax dependency tree of the short message text and extract the semantic conflict index; Based on the semantic conflict index, capture high-frequency operation behaviors in the device operation sequence to generate a behavior pattern encoding vector; According to the behavior pattern encoding vector, fuse the base station positioning trajectory and IP address jump features to construct a spatiotemporal anomaly topology graph; Tensor splice the behavior pattern encoding vector and the spatiotemporal anomaly topology graph to configure the dynamic feature pool; Wherein, before tensor splicing the behavior pattern encoding vector and the spatiotemporal anomaly topology graph, it also comprises: Using asymmetric KL divergence, quantify the distribution difference between the semantic association graph and the device behavior fingerprint, and perform quantile mutation detection of feature values within a sliding time window to configure the local outlier factor of spatiotemporal distribution characteristics; Based on the local outlier factor of spatiotemporal distribution characteristics, map the time series features to a two-dimensional matrix through Gram angle field transformation to extract spatial correlation features, which are used to dynamically correct the edge weight of the spatiotemporal anomaly topology graph; Wherein, the central computing node includes a feature selection layer based on attention mechanism, a time series dependence analysis layer and an adversarial sample filtering layer, which comprises: Using multi-head self-attention mechanism, weight assignment is performed on the cross-modal feature sequence, and a differentiable feature gating unit is introduced to filter redundant dimensions according to feature contribution to obtain preliminary screening selection features; Based on the preliminary screening selection features, the GRU hidden state of the time series dependence analysis layer and the attention weight are jointly optimized to construct a feature embedding space immune to adversarial perturbations; In the feature embedding space, determine the mutual information gradient between feature channels, and combine the confidence score of the resistance sample filtering layer to generate a nonlinear feature importance mask in the cascaded identification result.

2. The method of claim 1, wherein the method comprises: Construct a generative adversarial network for simulating attackers to forge the feature distribution of normal samples; Identify potential adversarial samples through the confidence difference output by the discriminator, and use feature reconstruction error and gradient mask strategy to suppress the gradient propagation of the potential adversarial samples.

3. The method of claim 2, wherein the method comprises: Adopting feature reconstruction error and gradient mask strategy to suppress the gradient propagation of the potential adversarial sample, further comprising: Inserting a gradient reversal layer after the last convolutional layer of the discriminator, dynamically adjusting the gradient direction, and forcing the adversarial sample to form a gradient flat area in the latent space.

4. The method of claim 1, wherein the method comprises: When the anomaly probability score exceeds the dynamic anomaly probability threshold, triggering a multi-stage verification mechanism, further comprising: According to the time decay factor of the historical abnormal event, determining the threshold baseline value; Based on the threshold baseline value, combining the current network environment risk level and the user identity trustworthiness, introducing a dynamic offset coefficient, and smoothing updating the dynamic anomaly probability threshold.

5. The method of claim 1, wherein the method comprises: Combining the context scene features for interactive risk verification, further comprising: Based on the center computing node, deploying edge computing nodes, performing distributed feature preprocessing on the dynamic feature pool, and dynamically offloading computing tasks according to device resource status; Through the offloaded computing tasks, configure lightweight detection sub-process; Using the lightweight detection sub-process, establish a local cache mechanism on the edge computing node, which is used to perform local interception operations.

6. The method of claim 5, wherein the method comprises: The local cache mechanism is used to perform local interception operations, including: Using LSH local sensitive hashing to establish behavior query index; Based on the behavior query index, determine the context scene features, including GPS trajectory clustering labels and application process CPU occupancy fluctuation; According to the context scene features, combine historical behavior baseline data to dynamically adjust the similarity fluctuation interval. If the similarity score does not meet the similarity threshold in the similarity fluctuation interval, the local interception operation is triggered.

7. An abnormal short message behavior detection system based on multi-dimensional feature fusion, characterized in that, The system is used to implement the anomaly SMS behavior detection method based on multi-dimensional feature fusion according to any one of claims 1 to 6, and the system comprises: A cross-modal feature sequence extraction module is used to collect the spatiotemporal distribution features, semantic association graph, and device behavior fingerprint of SMS interaction, configure a dynamic feature pool, and extract cross-modal feature sequences through a sliding time window to determine the mutual information entropy and abnormal deviation degree between each feature dimension; A cascaded recognition module is used to upload the mutual information entropy and abnormal deviation degree between each feature dimension to a center computing node for cascaded recognition. The center computing node includes a feature selection layer based on attention mechanism, a time series dependence analysis layer, and an adversarial sample filtering layer; An anomaly probability score generation module is used to dynamically adjust the feature fusion weight matrix according to the cascaded recognition result to generate an anomaly probability score. When the anomaly probability score exceeds the dynamic anomaly probability threshold, a multi-stage verification mechanism is triggered. An abnormal SMS behavior label determination module is used to match the time series pattern in the user historical behavior baseline on the edge computing node to dynamically generate a verification code trigger threshold, combine the context scene features for interactive risk verification, and determine the abnormal SMS behavior label.

Images